This Red Hat security advisory for AMQ Clients 2026.Q3 addresses multiple security flaws including denial of service via unbounded type nesting and symbol value caching in Apache Qpid Proton-J and ProtonJ2, arbitrary code execution via Jackson-databind polymorphic type validator bypass, authentication bypass in Spring Boot due to misconfigured Health Group additional path, HTTP request smuggling and header injection in Netty components, information disclosure and denial of service via XML External Entity in AssertJ, and other denial of service vulnerabilities in Micrometer, Netty, and Apache ActiveMQ components. The advisory includes fixes for these vulnerabilities and updates dependencies such as Netty, JUnit, Mockito, and others. The vulnerabilities collectively impact message sending and receiving capabilities in AMQ Clients interacting with AMQ Broker 7. The advisory does not specify exact affected versions but references Red Hat Enterprise Linux 8, 9, and 10 client package versions.

The vulnerabilities addressed in this advisory can lead to denial of service conditions, arbitrary code execution, authentication bypass, information disclosure, and HTTP request smuggling attacks. These impacts can disrupt messaging services, compromise system integrity, and expose sensitive information within environments using Red Hat AMQ Clients. The advisory rates the overall impact as important, with some vulnerabilities classified as high severity. No known exploits in the wild are reported at this time.

Red Hat has released an update for AMQ Clients 2026.Q3 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems have been applied. Detailed instructions for applying the update are available in the Red Hat advisory. No additional mitigation steps are indicated beyond applying the official update.