This advisory covers several vulnerabilities in Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, including CVE-2026-2332 (HTTP request smuggling via chunked extension quoted-string parsing in jetty-http), CVE-2026-6857 (remote code execution via unsafe deserialization in camel-infinispan), CVE-2026-40858 (arbitrary code execution via deserialization of untrusted data in camel-infinispan and camel-infinispan-common), and CVE-2026-40860 (remote code execution via deserialization of JMS ObjectMessage in camel-amqp and camel-jms). These vulnerabilities allow attackers to execute arbitrary or remote code through crafted inputs. The update RHBQ 3.33.1.GA addresses these issues to enhance security and stability.

The vulnerabilities allow for arbitrary or remote code execution through unsafe deserialization and HTTP request smuggling, which could lead to compromise of affected systems running Red Hat Build of Apache Camel 4.18 for Quarkus 3.33. This poses a significant risk to the confidentiality, integrity, and availability of affected deployments. Red Hat rates the security impact as Important, indicating a high risk but not necessarily critical. There are no known exploits in the wild at the time of this advisory.

An official update (RHBQ 3.33.1.GA) is available from Red Hat to address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. The vendor advisory provides the update download link (login required). Applying this update is the recommended remediation. Patch status is confirmed as available and official. No additional mitigations are specified by the vendor.