RHSA-2026:91304HighCVSS 8.1

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP1)

Published
October 27, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (3)

CVE-2026-104016 →CVE-2026-110747 →CVE-2026-110879 →

📋 Description

CVE-2026-104016 — com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf: jackson-dataformat-protobuf: Denial of Service via integer overflow during field parsing CVE-2026-110747 — com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf: jackson-dataformat-protobuf: Denial of Service via integer overflow in map key parsing CVE-2026-110879 — jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV

🎯 Affected products200

  • Red Hat Build of Apache Camel 3.33.4.SP1
  • ai.docling.docling-core-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ai.docling.docling-serve-api-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ai.docling.docling-serve-client-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • biz.aQute.bnd.biz.aQute.bnd.transform-6.3.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-base-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-caching-api-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-client-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2.1-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu3-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-structures-hl7org-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r4-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r5-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2016may-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu3-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.org.hl7.fhir.r4-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.org.hl7.fhir.r5-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.fhir.org.hl7.fhir.utilities-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • ca.uhn.hapi.hapi-base-2.6.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.aayushatharva.brotli4j.brotli4j-1.23.0.redhat-00004.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.23.0.redhat-00004.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.aayushatharva.brotli4j.service-1.23.0.redhat-00004.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.amazonaws.dynamodb-lock-client-1.4.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.atlassian.event.atlassian-event-6.0.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.atlassian.httpclient.atlassian-httpclient-api-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.atlassian.httpclient.atlassian-httpclient-library-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • com.atlassian.jira.jira-rest-java-client-api-6.0.2.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP1
  • +170 more not shown

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (5)