This advisory covers several vulnerabilities fixed in Red Hat Build of Apache Camel 4.18 for Quarkus 3.33. Notably, CVE-2026-56624 involves improper validation of OpenSSH user certificates in Apache MINA SSHD, allowing authenticated users to bypass command restrictions and execute unauthorized commands. CVE-2026-45112 and CVE-2026-48586 are denial of service vulnerabilities in Apache Thrift caused by uncontrolled resource allocation and improper handling of highly compressed data. CVE-2026-55471 is an XML External Entity (XXE) injection vulnerability in HAPI FHIR XsltUtilities that can lead to local file disclosure and server-side request forgery (SSRF). CVE-2026-55470 is a denial of service vulnerability via regular expression backtracking in the HAPI FHIR DSTU2 module. Red Hat has rated the update as important and recommends applying the update to address these issues.

The vulnerabilities collectively allow for unauthorized command execution, denial of service conditions, local file disclosure, and SSRF attacks. Specifically, improper certificate validation can lead to privilege escalation or unauthorized actions on the server. Denial of service vulnerabilities may cause service interruptions or resource exhaustion. XXE injection can expose sensitive local files and enable SSRF attacks, potentially compromising confidentiality and integrity of data. The regular expression backtracking issue can also cause denial of service by exhausting processing resources.

Red Hat has released an updated version of Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 (RHBQ 3.33.3.GA) that addresses these vulnerabilities. Users are advised to back up their existing installations and apply this update promptly to ensure security and stability. No alternative mitigations are specified in the advisory. Patch status is confirmed by the vendor advisory as an official fix.