This advisory covers multiple vulnerabilities fixed in HawtIO 4.2.0 for Red Hat build of Apache Camel 4 and related components. The key issues are: CVE-2024-52798, a ReDoS vulnerability in path-to-regexp 0.1.x; CVE-2024-12397, an HTTP Cookie Smuggling vulnerability in io.quarkus.http/quarkus-http-core; CVE-2025-22866, a panic caused by partial keys in crypto/x509; CVE-2025-24970, a native crash vulnerability in io.netty/netty-handler's SslHandler due to improper packet validation with native SSLEngine; and CVE-2024-57699, a potential Denial of Service via stack exhaustion in json-smart. The advisory references Red Hat errata RHSA-2025:8761 and RHSA-2025:0900 for detailed fixes and instructions.

These vulnerabilities can lead to denial of service conditions (via ReDoS or stack exhaustion), application crashes (native crash in Netty SslHandler, panic in crypto/x509), and HTTP cookie smuggling attacks which may allow bypassing security controls related to cookies. The combined impact affects the stability, security, and reliability of applications using these components in the Red Hat build of Apache Camel and Quarkus. No known exploits in the wild have been reported at this time.

Red Hat has released HawtIO 4.2.0 for the Red Hat build of Apache Camel 4 GA Release and updated Red Hat build of Quarkus 3.15.3 to address these vulnerabilities. Users should apply these updates after ensuring all previously released errata relevant to their systems are applied. Detailed update instructions are available at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.