Red Hat has released a security update for its build of Apache Camel 4.18 for Quarkus 3.33 that resolves 11 vulnerabilities affecting various components such as netty-handler, netty-resolver-dns, netty-codec-haproxy, netty-codec-http2, quarkus-vertx-http, and libthrift. The vulnerabilities include denial of service due to resource leaks and memory allocation issues, information disclosure and data manipulation from improper DNS record validation, authentication and authorization bypass via path normalization flaws, hostname verification bypass due to improper trust manager handling, IPv6 subnet rule bypass, and security bypass from improper certificate validation. These issues collectively impact the security and reliability of applications built on this platform. The advisory is identified as RHSA-2026:26586 and rated Important by Red Hat.

The vulnerabilities can lead to denial of service conditions, information disclosure, authentication and authorization bypass, hostname verification bypass, and security bypass due to improper certificate validation. These impacts may allow attackers to disrupt services, manipulate data, bypass security controls, or gain unauthorized access. The overall security impact is rated as Important by Red Hat, indicating significant risk to affected systems if unpatched.

A security update is available from Red Hat for the build of Apache Camel 4.18 for Quarkus 3.33 that addresses all listed vulnerabilities. Users should back up their existing installations and apply the update as provided by Red Hat. The vendor advisory (RHSA-2026:26586) is the authoritative source for patch availability and installation instructions. No additional mitigations are specified beyond applying the official update.