RHSA-2026:83670HighCVSS 8.6

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)

Published
October 15, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (24)

CVE-2026-91865 →CVE-2026-94449 →CVE-2026-19203 →CVE-2026-65432 →CVE-2026-89058 →CVE-2026-91777 →CVE-2026-91866 →CVE-2026-93994 →CVE-2026-94002 →CVE-2026-59296 →CVE-2026-71887 →CVE-2026-88033 →CVE-2026-89407 →CVE-2026-89425 →CVE-2026-91864 →CVE-2026-102496 →CVE-2026-88789 →CVE-2026-91863 →CVE-2026-93432 →CVE-2026-102495 →CVE-2026-68497 →CVE-2026-71889 →CVE-2026-88920 →CVE-2026-89059 →

📋 Description

CVE-2026-19203 — org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests CVE-2026-59296 — io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing CVE-2026-65432 — Apache CXF: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-71887 — org.bouncycastle/bcpg-jdk18on: org.bouncycastle/bcpg-jdk15to18: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation CVE-2026-71889 — org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks CVE-2026-88033 — org.mongodb/mongodb-driver-core: MongoDB Java Driver: Data disclosure and denial of service via query-operator injection in GridFS file IDs CVE-2026-88789 — org.apache.camel.quarkus/camel-quarkus-support-xalan: Apache Camel Quarkus: Information disclosure via XML external entity injection CVE-2026-88920 — org.apache.wss4j/wss4j-ws-security-dom: Apache WSS4J: Authentication bypass via unsigned SAML sender-vouches assertion CVE-2026-89058 — resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config CVE-2026-89059 — resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) CVE-2026-89407 — com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89425 — com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-91777 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion CVE-2026-91863 — org.apache.neethi/neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing CVE-2026-91864 — org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents CVE-2026-91865 — org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents CVE-2026-91866 — Neethi: Neethi: Denial of Service via crafted WS-Policy documents CVE-2026-93432 — io.quarkus.qute:quarkus-core: Cross-Site Scripting (XSS) and JSON Injection via Qute {#eval} Section in Quarkus CVE-2026-93994 — org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation CVE-2026-94002 — org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies CVE-2026-94449 — quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service CVE-2026-102495 — org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing CVE-2026-102496 — org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures

🎯 Affected products200

  • Red Hat Build of Apache Camel 3.33.4.redhat
  • ai.docling.docling-core-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ai.docling.docling-serve-api-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ai.docling.docling-serve-client-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • biz.aQute.bnd.biz.aQute.bnd.transform-6.3.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-base-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-caching-api-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-client-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2.1-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu3-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-structures-hl7org-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r4-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r5-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2016may-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu3-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.org.hl7.fhir.r4-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.org.hl7.fhir.r5-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.fhir.org.hl7.fhir.utilities-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • ca.uhn.hapi.hapi-base-2.6.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.aayushatharva.brotli4j.brotli4j-1.23.0.redhat-00004.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.23.0.redhat-00004.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.aayushatharva.brotli4j.service-1.23.0.redhat-00004.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.amazonaws.dynamodb-lock-client-1.4.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.atlassian.event.atlassian-event-6.0.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.atlassian.httpclient.atlassian-httpclient-api-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.atlassian.httpclient.atlassian-httpclient-library-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • com.atlassian.jira.jira-rest-java-client-api-6.0.2.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.redhat
  • +170 more not shown

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Update Apache CXF to a version that includes the fix. Disable DTD processing and external entity resolution in XML parsers. Avoid processing untrusted WSDL/XSD imports. Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: Do not use PKIXCertPathReviewer for trust or path validation decisions. Instead, validate certificate paths using the standard Java Cryptography Architecture via CertPathValidator.getInstance("PKIX", "BC"). Workaround: Mitigation for this issue involves ensuring that applications using the MongoDB Java Driver's GridFS component rigorously validate and sanitize all user-supplied input intended for file identifiers. Restricting access to such applications to only trusted users can further reduce the attack surface. Workaround: Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24. Example `pom.xml`: ``` <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.18.11</version> </dependency> ``` Verify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind` If you cannot upgrade directly, apply defense-in-depth mitigations: - Restrict JSON request size - Audit and remove unnecessary @JsonIdentityInfo Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Apache Neethi project has addressed this issue in version 3.2.4; users of affected Red Hat products should apply updated product releases containing the fixed component through their standard update channels when they become available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Apache Neethi project addressed this flaw in version 3.2.4. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Apache Neethi project has addressed this issue in version 3.2.4; users of affected Red Hat products should install product-specific updates as they become available through their respective update channels. Workaround: Users who cannot immediately upgrade can mitigate this issue by updating their templates to use the str:eval extension method instead of the {#eval} section helper. Vulnerable pattern: {#eval snippet /} Secure alternative: {str:eval(snippet)} Workaround: There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, if using Apache MINA SSHD with multi-key authentication configured, consider implementing additional authentication mechanisms (password, OTP) or restricting SSH access to trusted networks until patches are applied. Workaround: There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, only connect to trusted SFTP servers, implement monitoring to detect abnormal memory consumption in SFTP client processes, and configure resource limits (ulimit, cgroups) to prevent a single process from exhausting all available memory.

🔗 References (47)