Red Hat released an important security update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 (RHBQ 3.33.3.GA) addressing several vulnerabilities: CVE-2026-56624 in Apache MINA SSHD allows unauthorized command execution due to improper validation of OpenSSH user certificates; CVE-2026-45112 and CVE-2026-48586 in Apache Thrift cause denial of service via uncontrolled resource allocation and improper handling of highly compressed data; CVE-2026-55471 in HAPI FHIR XsltUtilities enables XML External Entity injection leading to local file disclosure and SSRF; CVE-2026-55470 in HAPI FHIR DSTU2 module causes denial of service through regular expression backtracking. The vendor advisory confirms a patch is available and recommends updating to the fixed version.

The vulnerabilities collectively can lead to unauthorized command execution, denial of service conditions, local file disclosure, and server-side request forgery. Specifically, improper certificate validation in SSHD can allow authenticated users to bypass restrictions and execute unintended commands. Denial of service vulnerabilities in Apache Thrift and HAPI FHIR modules can cause resource exhaustion or application crashes. XML External Entity injection can disclose sensitive local files and enable SSRF attacks.

A security update (RHBQ 3.33.3.GA) is available from Red Hat that addresses these vulnerabilities. Users should back up their existing installations and apply this update promptly to ensure security and stability. No additional mitigations are indicated by the vendor advisory beyond applying the official patch.