RHSA-2026:3890HighCVSS 9.6

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14.4 for Spring Boot release.

Published
March 5, 2026
Last Modified
August 7, 2026

🔗 CVE IDs covered (4)

CVE-2025-12543 →CVE-2026-1002 →CVE-2026-27727 →CVE-2026-27830 →

📋 Description

CVE-2025-12543 — undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF CVE-2026-1002 — io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files CVE-2026-27727 — com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects CVE-2026-27830 — c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

🎯 Affected products1

  • Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use, applicability, or stability. Workaround: To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example: ~~~ StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false); ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)