RHSA-2026:70257HighCVSS 8.6

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)

Published
September 22, 2026
Last Modified
October 9, 2026

🔗 CVE IDs covered (21)

CVE-2026-77874 →CVE-2026-93488 →CVE-2026-93564 →CVE-2026-93567 →CVE-2026-93568 →CVE-2026-19611 →CVE-2026-87795 →CVE-2026-12860 →CVE-2026-58059 →CVE-2026-87825 →CVE-2026-90560 →CVE-2026-93491 →CVE-2026-93558 →CVE-2026-93569 →CVE-2026-59649 →CVE-2026-87824 →CVE-2026-87877 →CVE-2026-89046 →CVE-2026-90852 →CVE-2026-93565 →CVE-2026-45799 →

📋 Description

CVE-2026-12860 — org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification CVE-2026-19611 — wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding CVE-2026-45799 — com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation CVE-2026-58059 — org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names CVE-2026-59649 — org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length CVE-2026-77874 — org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass CVE-2026-87795 — com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service CVE-2026-87824 — com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect CVE-2026-87825 — com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability CVE-2026-87877 — com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service CVE-2026-89046 — zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read CVE-2026-90560 — com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress CVE-2026-90852 — com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing CVE-2026-93488 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams CVE-2026-93491 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue CVE-2026-93558 — io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service CVE-2026-93564 — io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) CVE-2026-93565 — io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte CVE-2026-93567 — io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority CVE-2026-93568 — io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests CVE-2026-93569 — io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

🎯 Affected products200

  • Red Hat Build of Apache Camel 3.33.3.SP2
  • ai.docling.docling-core-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ai.docling.docling-serve-api-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ai.docling.docling-serve-client-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • at.yawk.lz4.lz4-java-1.10.1.rhel8-redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • biz.aQute.bnd.biz.aQute.bnd.transform-6.3.1.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-base-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-caching-api-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-client-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2-8.6.5.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2.1-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu3-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-structures-hl7org-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r4-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r5-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2016may-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu3-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.org.hl7.fhir.r4-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.org.hl7.fhir.r5-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.fhir.org.hl7.fhir.utilities-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • ca.uhn.hapi.hapi-base-2.6.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.aayushatharva.brotli4j.brotli4j-1.23.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.23.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.aayushatharva.brotli4j.service-1.23.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.amazonaws.dynamodb-lock-client-1.4.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.atlassian.event.atlassian-event-6.0.0.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.atlassian.httpclient.atlassian-httpclient-api-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.atlassian.httpclient.atlassian-httpclient-library-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • com.atlassian.jira.jira-rest-java-client-api-6.0.2.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.3.SP2
  • +170 more not shown

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpg-fips 1.0.13/2.0.13/2.1.13) once available for the affected product. Workaround: To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use. Workaround: Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress. Workaround: No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available. Workaround: No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available. Workaround: Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation. Workaround: Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.

🔗 References (26)