Red Hat has released a security update for its build of Apache Camel 4.18 for Quarkus 3.33 that addresses multiple vulnerabilities in components such as Netty and Apache Thrift. Notable fixes include CVE-2026-43868, a denial of service vulnerability caused by excessive memory allocation in Apache Thrift, and CVE-2026-45416, a denial of service in Netty due to eager buffer allocation during TLS handshake. Other issues fixed include information disclosure from improper DNS record validation, hostname verification bypass, memory leaks from malformed HAProxy protocol headers, IPv6 subnet rule bypass, and authentication bypass via path normalization. Red Hat rates these vulnerabilities as important and recommends applying the update. Configuration changes to Netty's SslClientHelloHandler to specify a maximum client hello length can mitigate some issues. The update is available via Red Hat's official advisory RHSA-2026:26586.

The vulnerabilities collectively can lead to denial of service conditions through resource exhaustion or memory leaks, information disclosure, authentication bypass, and improper certificate validation. These impacts can affect the availability and security of applications using the affected Red Hat build of Apache Camel for Quarkus. No known active exploitation has been reported. The issues affect the stability and security of applications relying on the vulnerable components.

A security update is available from Red Hat and should be applied to affected systems. Before updating, back up all relevant data and configurations. For the Netty TLS handshake denial of service (CVE-2026-45416), configure the SslClientHelloHandler with a non-zero maxClientHelloLength parameter to enable length validation and prevent excessive memory allocation. Restart affected services after applying configuration changes. Follow the official Red Hat advisory RHSA-2026:26586 for detailed update instructions and further mitigation guidance.