This advisory covers three security vulnerabilities fixed in Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 via the RHBQ 3.27.3.GA update. CVE-2026-1002 involves a vulnerability in vertx-core where the static handler component cache can be manipulated to deny access to static files. CVE-2026-33870 is a Netty HTTP request smuggling vulnerability caused by incorrect parsing of HTTP/1.1 chunked transfer encoding extension values in netty-codec-http. CVE-2026-33871 is a denial of service vulnerability in netty-codec-http2 triggered by flooding HTTP/2 CONTINUATION frames. The Red Hat advisory (RHSA-2026:8159) provides this update to enhance security and stability. No CVSS scores are provided. The vendor recommends applying the update after backing up existing installations.

Successful exploitation of CVE-2026-1002 could allow an attacker to manipulate the static handler cache, resulting in denial of access to static files. CVE-2026-33870 could enable HTTP request smuggling attacks due to improper parsing of chunked transfer encoding extensions, potentially leading to request misrouting or bypassing security controls. CVE-2026-33871 could allow denial of service by flooding HTTP/2 CONTINUATION frames, impacting service availability. These vulnerabilities affect the security and stability of applications using the affected components.

Red Hat has released an update (RHBQ 3.27.3.GA) for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 that addresses these vulnerabilities. Users should back up their existing installations, including applications and configurations, before applying the update. Applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.