This advisory covers three security vulnerabilities fixed in Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 (RHBQ 3.27.3.GA). CVE-2026-1002 involves a cache manipulation in the vertx-core static handler component that can deny access to static files. CVE-2026-33870 is a request smuggling vulnerability in the Netty HTTP codec due to incorrect parsing of HTTP/1.1 chunked transfer encoding extension values. CVE-2026-33871 is a denial of service vulnerability in Netty HTTP/2 codec caused by flooding with CONTINUATION frames. These vulnerabilities affect the security and stability of the product and have been addressed in the update.

Successful exploitation of CVE-2026-1002 can result in denial of access to static files by manipulating the static handler cache. CVE-2026-33870 allows HTTP request smuggling due to improper parsing, which can lead to request confusion or bypassing security controls. CVE-2026-33871 enables denial of service attacks by flooding the HTTP/2 CONTINUATION frames, potentially disrupting service availability. These vulnerabilities collectively impact the confidentiality, integrity, and availability of applications using the affected components.

Red Hat has released an updated version RHBQ 3.27.3.GA of Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 that addresses these vulnerabilities. Users should back up their existing installations, including applications and configurations, before applying the update. Applying this update is the recommended remediation to ensure security and stability. No alternative mitigations or workarounds are specified in the advisory.