RHSA-2026:63302
Vulnerability from csaf_redhat - Published: 2026-09-03 18:34 - Updated: 2026-09-04 08:25Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
Severity
Important
Notes
Topic: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.Red Hat Product Security has rated this update as having a security impact of Important.
Details: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:
* httpclient5-cache: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] ()
* httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] ()
* camel-quarkus-support-httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] ()
* netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [rhboac-camel-quarkus-3] (CVE-2026-62243)
* camel-quarkus-support-httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification [rhboac-camel-quarkus-3] (CVE-2026-71290)
* quarkus-apache-httpclient: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] (CVE-2026-64607)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [rhboac-camel-quarkus-3] (CVE-2026-66257)
* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [rhboac-camel-quarkus-3] (CVE-2026-66273)
* mongodb-driver-legacy: MongoDB Driver: Credential disclosure via cleartext logging during client initialization [rhboac-camel-quarkus-3] ()
* mongodb-driver-core: MongoDB Driver: Credential disclosure via cleartext logging during client initialization [rhboac-camel-quarkus-3] (CVE-2026-18710)
* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [rhboac-camel-quarkus-3] (CVE-2026-17615)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [rhboac-camel-quarkus-3] (CVE-2026-66274)
* quarkus-qute: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine [rhboac-camel-quarkus-3] ()
* camel-quarkus-qute-component: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine [rhboac-camel-quarkus-3] ()
* camel-quarkus-qute: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine [rhboac-camel-quarkus-3] (CVE-2026-12894)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in org.mongodb/mongodb-driver. During routine client initialization, sensitive configuration information, including credentials for outbound network connectivity, is written to application log output in cleartext. A local attacker with the ability to read the affected application's logs or downstream log-aggregation storage could recover these credentials. This allows them to reuse the credentials to authenticate to the associated network infrastructure, leading to information disclosure.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security (TLS) hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can impersonate the server, leading to a Man-in-the-Middle (MITM) attack and compromising communication.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
64 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.Red Hat Product Security has rated this update as having a security impact of Important.",
"title": "Topic"
},
{
"category": "general",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1).The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* httpclient5-cache: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] ()\n* httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] ()\n* camel-quarkus-support-httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] ()\n* netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [rhboac-camel-quarkus-3] (CVE-2026-62243)\n* camel-quarkus-support-httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification [rhboac-camel-quarkus-3] (CVE-2026-71290)\n* quarkus-apache-httpclient: Apache HttpComponents Client: Denial of Service due to connection leak [rhboac-camel-quarkus-3] (CVE-2026-64607)\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [rhboac-camel-quarkus-3] (CVE-2026-66257)\n* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [rhboac-camel-quarkus-3] (CVE-2026-66273)\n* mongodb-driver-legacy: MongoDB Driver: Credential disclosure via cleartext logging during client initialization [rhboac-camel-quarkus-3] ()\n* mongodb-driver-core: MongoDB Driver: Credential disclosure via cleartext logging during client initialization [rhboac-camel-quarkus-3] (CVE-2026-18710)\n* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [rhboac-camel-quarkus-3] (CVE-2026-17615)\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [rhboac-camel-quarkus-3] (CVE-2026-66274)\n* quarkus-qute: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine [rhboac-camel-quarkus-3] ()\n* camel-quarkus-qute-component: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine [rhboac-camel-quarkus-3] ()\n* camel-quarkus-qute: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine [rhboac-camel-quarkus-3] (CVE-2026-12894)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:63302",
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-62243",
"url": "https://access.redhat.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-71290",
"url": "https://access.redhat.com/security/cve/CVE-2026-71290"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66257",
"url": "https://access.redhat.com/security/cve/CVE-2026-66257"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66273",
"url": "https://access.redhat.com/security/cve/CVE-2026-66273"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18710",
"url": "https://access.redhat.com/security/cve/CVE-2026-18710"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-17615",
"url": "https://access.redhat.com/security/cve/CVE-2026-17615"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66274",
"url": "https://access.redhat.com/security/cve/CVE-2026-66274"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12894",
"url": "https://access.redhat.com/security/cve/CVE-2026-12894"
},
{
"category": "external",
"summary": "2507635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507635"
},
{
"category": "external",
"summary": "2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "2514394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514394"
},
{
"category": "external",
"summary": "2514429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514429"
},
{
"category": "external",
"summary": "2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63302.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)",
"tracking": {
"current_release_date": "2026-09-04T08:25:06+00:00",
"generator": {
"date": "2026-09-04T08:25:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:63302",
"initial_release_date": "2026-09-03T18:34:09+00:00",
"revision_history": [
{
"date": "2026-09-03T18:34:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-03T18:34:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-04T08:25:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1",
"product": {
"name": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1",
"product_id": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_quarkus:3.33"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"icysun"
]
}
],
"cve": "CVE-2026-12894",
"cwe": {
"id": "CWE-1336",
"name": "Improper Neutralization of Special Elements Used in a Template Engine"
},
"discovery_date": "2026-05-07T17:10:27+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491319"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "quarkus-qute: io.quarkus.qute.ReflectionValueResolver: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important server-side template injection vulnerability in the Quarkus Qute template engine. An attacker with the ability to supply or modify template content can bypass security filters designed to restrict access to sensitive Java methods. This bypass allows for arbitrary remote code execution within the context of the Java process, leading to a complete compromise of the affected application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12894"
},
{
"category": "external",
"summary": "RHBZ#2491319",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491319"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12894"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12894",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12894"
}
],
"release_date": "2026-08-31T11:30:40.187000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "Applications utilizing the Quarkus Qute template engine should ensure that untrusted input is not directly incorporated into template content. Restricting access to the application\u0027s template rendering functionality to trusted sources can reduce the attack surface.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "quarkus-qute: io.quarkus.qute.ReflectionValueResolver: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine"
},
{
"acknowledgments": [
{
"names": [
"Leon Zlobecki"
]
}
],
"cve": "CVE-2026-17615",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2026-07-27T19:27:51.528000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507635"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RESTEasy\u0027s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "resteasy-core: RESTeasy SourceProvider remote unauthenticated file read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw allows unauthenticated remote file disclosure due to improper XML external entity (XXE) resolution in RESTEasy\u0027s SourceProvider. An attacker can exploit this by sending a crafted XML request to an exposed endpoint that processes `application/xml` and returns `Source` or `StreamSource` types, leading to the disclosure of sensitive server-side files. This affects applications utilizing RESTEasy where endpoints are configured to accept XML input and return `Source` or `StreamSource` objects, potentially exposing sensitive data on Red Hat supported products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-17615"
},
{
"category": "external",
"summary": "RHBZ#2507635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-17615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17615"
}
],
"release_date": "2026-08-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid exposing RESTEasy endpoints that return Source or StreamSource types. Alternatively, implement a custom MessageBodyWriter for Source types that explicitly applies XML security features to the SAXParserFactory before parsing. Changes to application configuration or code typically require an application redeployment or restart to take effect.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "resteasy-core: RESTeasy SourceProvider remote unauthenticated file read"
},
{
"cve": "CVE-2026-18710",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"discovery_date": "2026-08-11T22:11:27.816772+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.mongodb/mongodb-driver. During routine client initialization, sensitive configuration information, including credentials for outbound network connectivity, is written to application log output in cleartext. A local attacker with the ability to read the affected application\u0027s logs or downstream log-aggregation storage could recover these credentials. This allows them to reuse the credentials to authenticate to the associated network infrastructure, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has Moderate impact. A flaw in MongoDB driver components used by Red Hat products can lead to sensitive credential disclosure. During client initialization, credentials for outbound network connectivity are automatically written in cleartext to application logs. An attacker with local access to these logs could recover and reuse the credentials, compromising confidentiality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18710"
},
{
"category": "external",
"summary": "RHBZ#2514429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18710"
},
{
"category": "external",
"summary": "https://jira.mongodb.org/browse/JAVA-6266",
"url": "https://jira.mongodb.org/browse/JAVA-6266"
}
],
"release_date": "2026-08-11T22:00:07.172000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that access to application logs and any downstream log aggregation storage is strictly controlled. Implement robust access control mechanisms to prevent unauthorized parties from reading log output, as this is where sensitive credentials may be exposed in cleartext during MongoDB driver client initialization. Regularly review and audit log access permissions.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization"
},
{
"cve": "CVE-2026-62243",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-22T12:51:41.376413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit \u2014 full confidentiality compromise of TLS-protected traffic without authentication \u2014 the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "RHBZ#2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass",
"url": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass"
}
],
"release_date": "2026-08-22T12:26:43.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). \n\nThe following mitigations can reduce exposure without applying a patch:\n\n1) Use the default JDK SSL provider \u2014 Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden.\n\n2) Use X509ExtendedTrustManager \u2014 If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic.\n\n3) Run on Java 24 or earlier \u2014 The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-66257",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:13.741100+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache Qpid Proton-J, allowing a pre-authentication attacker to exhaust system resources through unbounded symbol value caching. This can lead to service unavailability in Red Hat products utilizing affected versions of Proton-J that expose a network endpoint. The vulnerability\u0027s impact is significant due to the potential for unauthenticated remote attackers to disrupt service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66257"
},
{
"category": "external",
"summary": "RHBZ#2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm",
"url": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm"
}
],
"release_date": "2026-08-05T05:18:01.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching"
},
{
"cve": "CVE-2026-66273",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:00.913036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Apache Qpid Proton-J allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted messages, an attacker can trigger excessive memory allocation, leading to resource exhaustion in applications utilizing the library within Red Hat products such as AMQ, Quarkus, Camel, and EAP.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66273"
},
{
"category": "external",
"summary": "RHBZ#2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66273"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh",
"url": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh"
}
],
"release_date": "2026-08-05T05:23:31.964000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation"
},
{
"cve": "CVE-2026-66274",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T07:00:53.637061+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication or complex attack prerequisites.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66274"
},
{
"category": "external",
"summary": "RHBZ#2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66274"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h",
"url": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h"
}
],
"release_date": "2026-08-05T05:29:44.681000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting"
},
{
"cve": "CVE-2026-71290",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-11T20:51:00.503596+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514394"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security (TLS) hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can impersonate the server, leading to a Man-in-the-Middle (MITM) attack and compromising communication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as it allows for server impersonation in Red Hat products utilizing the asynchronous Apache HttpComponents Client. An attacker positioned to intercept and alter network traffic can present a fraudulent server certificate, bypassing TLS hostname verification and potentially leading to man-in-the-middle attacks. This flaw does not affect the classic version of HttpClient.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71290"
},
{
"category": "external",
"summary": "RHBZ#2514394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514394"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71290"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq",
"url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq"
}
],
"release_date": "2026-08-11T20:33:56.947000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T18:34:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63302"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…