This advisory covers several vulnerabilities in Red Hat Build of Apache Camel 4.18 for Quarkus 3.33. Notably, CVE-2026-54513 and CVE-2026-54512 are critical flaws in jackson-databind where insufficient validation of array component types in BasicPolymorphicTypeValidator allows attackers to bypass type validation and execute arbitrary code. CVE-2026-40983 and CVE-2026-40984 are denial of service vulnerabilities in micrometer-core triggered by specially crafted gRPC and HTTP requests. CVE-2026-49875 is an information disclosure vulnerability in Apache CXF caused by missing JAXP hardening, enabling out-of-band external entity resolution. Red Hat rates the overall security impact as Important and recommends updating to the fixed versions to mitigate these risks.

Successful exploitation of the jackson-databind vulnerabilities can lead to arbitrary code execution, resulting in full system compromise affecting confidentiality, integrity, and availability. The micrometer-core vulnerabilities allow denial of service attacks, potentially disrupting service availability. The Apache CXF vulnerability can lead to information disclosure through external entity resolution. These combined issues pose significant risks to affected systems if unpatched.

Red Hat advises applying the update RHBQ 3.33.2.SP2 which contains fixes for all listed vulnerabilities. For the jackson-databind issues, upgrading to versions 2.18.8, 2.21.4, or 3.1.4 or later is recommended. If immediate upgrade is not possible, removing BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from ObjectMapper configuration and disabling polymorphic deserialization of untrusted data can mitigate the risk. Back up existing installations before applying updates. No other specific mitigations are detailed beyond applying the vendor-provided update.