Red Hat has released an important security update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 (RHBQ 3.33.1.GA) addressing multiple vulnerabilities: CVE-2026-40858 and CVE-2026-6857 involve arbitrary and remote code execution via unsafe deserialization in camel-infinispan components; CVE-2026-40860 involves remote code execution via deserialization of JMS ObjectMessage in camel-amqp and camel-jms; CVE-2026-2332 is an HTTP request smuggling vulnerability in jetty-http related to chunked extension quoted-string parsing. These vulnerabilities pose a high security risk and are rated as Important by Red Hat Product Security. The advisory recommends updating to the fixed version to mitigate these issues.

The vulnerabilities allow attackers to execute arbitrary or remote code via unsafe deserialization of untrusted data in several Apache Camel components, potentially leading to full compromise of affected systems. The HTTP request smuggling vulnerability could allow attackers to interfere with HTTP request processing, potentially bypassing security controls or causing denial of service. These issues impact confidentiality and integrity but not availability according to the CVSS vector provided for CVE-2026-2332.

Red Hat has released an updated version (RHBQ 3.33.1.GA) of Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 that addresses these vulnerabilities. Users should back up their existing installations and apply this update promptly to ensure security and stability. No additional mitigations are specified or required beyond applying the official update.