RHSA-2026:95622HighCVSS 8.1

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3)

Published
November 5, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (12)

CVE-2026-78384 →CVE-2026-90559 →CVE-2026-93452 →CVE-2026-97791 →CVE-2026-102460 →CVE-2026-102554 →CVE-2026-107937 →CVE-2026-77711 →CVE-2026-97468 →CVE-2026-102477 →CVE-2026-108039 →CVE-2026-108106 →

📋 Description

CVE-2026-77711 — org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling CVE-2026-78384 — org.apache.cxf/cxf-core: Apache CXF: Denial of Service via uncontrolled data decompression CVE-2026-90559 — org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds write CVE-2026-93452 — org.xerial.snappy/snappy-java: snappy-java: Denial of Service due to buffer overflow in Snappy.compress CVE-2026-97468 — org.apache.cxf/cxf-rt-ws-security: org.apache.cxf/cxf-services-sts-core: Apache CXF: Authentication bypass via hash collision in token cache CVE-2026-97791 — org.apache.cxf/cxf-rt-ws-security: Apache CXF: Authentication bypass via shared token validation state CVE-2026-102460 — io.vertx/vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure CVE-2026-102477 — io.vertx/vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb CVE-2026-102554 — com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization CVE-2026-107937 — org.apache.cxf/cxf-core: Apache CXF: Denial of Service via large multipart attachment headers CVE-2026-108039 — org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing CVE-2026-108106 — org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression

🎯 Affected products200

  • Red Hat Build of Apache Camel 3.33.4.SP3
  • ai.docling.docling-core-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ai.docling.docling-serve-api-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ai.docling.docling-serve-client-0.4.4.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • at.yawk.lz4.lz4-java-1.11.4.rhel8-redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • biz.aQute.bnd.biz.aQute.bnd.transform-6.3.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-base-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-caching-api-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-client-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu2.1-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-structures-dstu3-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-structures-hl7org-dstu2-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r4-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.hapi-fhir-structures-r5-8.10.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu2016may-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.org.hl7.fhir.dstu3-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.org.hl7.fhir.r4-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.org.hl7.fhir.r5-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.fhir.org.hl7.fhir.utilities-6.9.12.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • ca.uhn.hapi.hapi-base-2.6.0.redhat-00002.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.aayushatharva.brotli4j.brotli4j-1.24.0.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.24.0.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.aayushatharva.brotli4j.service-1.24.0.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.amazonaws.dynamodb-lock-client-1.4.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.atlassian.event.atlassian-event-6.0.0.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.atlassian.httpclient.atlassian-httpclient-api-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.atlassian.httpclient.atlassian-httpclient-library-4.0.1.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • com.atlassian.jira.jira-rest-java-client-api-6.0.2.redhat-00001.jar as a component of Red Hat Build of Apache Camel 3.33.4.SP3
  • +170 more not shown

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Reject untrusted compressed input or enforce a verified maximum decompressed size before invoking the ByteBuffer decompression API. Workaround: Validate destination buffer capacity against maximum theoretical compressed payload size prior to invoking Snappy.compress, or restrict untrusted compressed input vectors at network application boundaries. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream Apache CXF has addressed this issue in versions 4.2.4, 4.1.9, and 3.6.13; Red Hat customers should apply updated packages for their supported product streams when they become available. Workaround: As a workaround, configure STSTokenValidator with alwaysValidateToSts enabled so that every incoming SAML token is always sent to the Security Token Service (STS) for validation rather than being accepted based on the local certificate-trust check; services configured this way are not exposed to the shared validation state. No other mitigation is currently available beyond this configuration change and applying updates for affected products once fixed packages are released. Workaround: Avoid chaining authentication handlers on nested routes where parent routes pre-authenticate requests, or enforce scope validation explicitly within route handler logic rather than delegating to ChainAuthHandler.

🔗 References (27)