Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 vulnerabilities

8 known vulnerabilities in Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 from Red Hat. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  jackson-databind: Incomplete List of Disallowed Inputs

  CVE-2026-54513Jun 23, 2026FasterXMLEPSS 1.23%

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only

• 9.8 Critical severity

  Apache CXF: Improper Restriction of XML External Entity Reference

  CVE-2026-49875Jun 12, 2026Apache

  Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or

• 7.5 High severity

  Micrometer: Uncontrolled Resource Consumption

  CVE-2026-40984Jun 9, 2026Spring

  In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.1

• 7.5 High severity

  Micrometer: Uncontrolled Resource Consumption

  CVE-2026-40983Jun 9, 2026Spring

  In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.

• 8.8 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-40858Apr 27, 2026ApacheEPSS 1.31%

  The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache use

• 7.5 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-40860Apr 27, 2026ApacheEPSS 1.74%

  JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or cl

• 7.5 High severity

  Red Hat build of Apache Camel 4.18.1 for…: Deserialization of Untrusted Data

  CVE-2026-6857Apr 22, 2026Red Hat

  A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code exe

• 9.1 Critical severity

  Eclipse Jetty: Inconsistent Interpretation of HTTP Requests

  CVE-2026-2332Apr 14, 2026Eclipse FoundationEPSS 1.36%

  In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html