This advisory covers a patch release for Red Hat Build of Apache Camel 4.14.2 for Spring Boot that addresses three security vulnerabilities: CVE-2025-9784, a critical HTTP/2 DDoS vulnerability in undertow-core known as 'MadeYouReset'; CVE-2025-66516, an update expanding the scope of affected artifacts in Apache Tika core and its PDF parser module; and CVE-2025-48924, an uncontrolled recursion vulnerability in Apache Commons Lang. The update is classified as critical by Red Hat Product Security and is intended to fix these issues in the affected product. The advisory references Red Hat’s errata RHSA-2025:23143 and instructs users to apply this update after all previously released errata relevant to their system have been applied.

The vulnerabilities fixed include a critical HTTP/2 denial-of-service vector that could be exploited to disrupt service, an expanded scope of parsing vulnerabilities in Apache Tika components that could lead to potential security issues, and an uncontrolled recursion flaw in Apache Commons Lang that may cause application instability or crashes. These issues collectively pose a risk of service disruption and potential exploitation if left unpatched.

A security update for Red Hat Build of Apache Camel 4.14.2 for Spring Boot is available and should be applied. Users must ensure all previously released errata relevant to their systems are applied before this update. Refer to Red Hat’s official advisory RHSA-2025:23143 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.