This advisory covers a security update for Red Hat build of Apache Camel 4.8.5 for Spring Boot that fixes several vulnerabilities. The json-smart component had a potential denial-of-service via stack exhaustion, which was an incomplete fix for a previous CVE (CVE-2023-1370), now addressed as CVE-2024-57699. SmallRye Fault Tolerance has a vulnerability identified as CVE-2025-2240. Spring Security's BCryptPasswordEncoder did not enforce a maximum password length, tracked as CVE-2025-22228. Netty's SslHandler failed to correctly validate packets, potentially causing native crashes when using the native SSLEngine (CVE-2025-24970). Apache Camel HTTP and HTTP-base components are vulnerable to bypass of header filters via specially crafted responses (CVE-2025-27636). Red Hat rates the update as important and recommends applying it after prior errata. No CVSS scores are provided in the advisory; users should refer to the CVE pages for detailed scoring and impact information.

The vulnerabilities fixed in this update could lead to denial-of-service conditions (via stack exhaustion), native crashes in SSL handling, bypass of security header filters, and improper enforcement of password length policies. These issues could affect the stability and security posture of applications using the affected components. The advisory does not report any known exploits in the wild. The overall security impact is rated as important by Red Hat.

A security update for Red Hat build of Apache Camel 4.8.5 for Spring Boot is available and should be applied. Before applying this update, ensure all previously released relevant errata have been installed. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are indicated by the vendor advisory.