This Red Hat security advisory (RHSA-2025:9697) announces a patch release for Red Hat build of Apache Camel 4.10.3 for Spring Boot that addresses three security vulnerabilities: CVE-2024-13009 in jetty-server involving gzip request body buffer corruption, CVE-2025-48734 in Apache Commons BeanUtils where PropertyUtilsBean fails to suppress an enum's declaredClass property by default, and CVE-2025-49146 in PostgreSQL JDBC involving insecure authentication in channel binding. The advisory rates the update as important and recommends applying the patch after ensuring all previous errata are applied. The advisory does not provide CVSS scores but references CVE links for detailed severity ratings.

The vulnerabilities fixed include a buffer corruption issue in Jetty server that could lead to memory corruption or denial of service, a property suppression flaw in Apache Commons BeanUtils that may affect security controls relying on property filtering, and an insecure authentication mechanism in PostgreSQL JDBC channel binding that could weaken authentication security. These issues collectively pose a high security risk if left unpatched, potentially allowing attackers to exploit memory corruption, bypass security controls, or compromise authentication.

A patch release for Red Hat build of Apache Camel 4.10.3 for Spring Boot is available that addresses these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Refer to the official Red Hat advisory RHSA-2025:9697 and the update instructions at https://access.redhat.com/articles/11258 for detailed patching guidance.