Red Hat has released a critical security advisory (RHSA-2026:19835) for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 (RHBQ 3.27.3.SP2) that addresses five CVEs: CVE-2026-33454, CVE-2026-40453, CVE-2026-42402, CVE-2026-42403, and CVE-2026-42404. The vulnerabilities include denial of service via circular policy references and algorithmic complexity in Apache Neethi, information disclosure and network access bypass via the PolicyReference API in Apache Neethi, remote code execution and arbitrary file write via case-variant header injection in Apache Camel components camel-google-pubsub and camel-jms, and altered application behavior via header injection in Camel-Mail. These issues pose critical risks to confidentiality, integrity, and availability of affected systems. The advisory recommends updating to the fixed version RHBQ 3.27.3.SP2 to mitigate these vulnerabilities.

The vulnerabilities collectively allow attackers to cause denial of service, disclose sensitive information, bypass network access controls, execute remote code, write arbitrary files, and alter application behavior. This can lead to compromise of affected systems running Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, impacting confidentiality, integrity, and availability. The severity is rated critical due to the presence of remote code execution and information disclosure issues without requiring privileges or user interaction.

Red Hat has released an official update (RHBQ 3.27.3.SP2) that addresses these vulnerabilities. Users should back up their existing installations and apply the update promptly to ensure security and stability. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as an official fix available from Red Hat.