This Red Hat security advisory announces the release of Apache Camel 4.4.2 for Spring Boot with fixes for three security vulnerabilities: CVE-2024-5971, an unrestricted memory consumption vulnerability in Apache CXF HTTP clients; CVE-2024-7885, an improper state management issue in undertow's Proxy Protocol parsing causing information leakage; and CVE-2024-38808, a vulnerability in the Spring Expression component. The advisory does not provide CVSS scores but rates the impact as important. Users are advised to apply the update after ensuring all previous errata are applied. The advisory references Red Hat's errata RHSA-2024:6508 for detailed remediation instructions.

The vulnerabilities fixed include an information leakage risk due to improper state management in Proxy Protocol parsing, a potential denial of service or resource exhaustion from unrestricted memory consumption in CXF HTTP clients, and a security issue in Spring Expression. These could lead to unauthorized information disclosure or resource exhaustion impacting availability. Red Hat rates the overall impact as important, indicating a significant security concern but not critical.

Red Hat has released an official security update in Apache Camel 4.4.2 for Spring Boot that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released relevant errata are installed. Detailed update instructions are available in the Red Hat advisory RHSA-2024:6508. No additional mitigations are specified or required beyond applying this official update.