Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
An update for Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3). The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products: * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [rhboac-camel-quarkus-3] (CVE-2026-59899) * netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [rhboac-camel-quarkus-3] (CVE-2026-56819) * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [rhboac-camel-quarkus-3] (CVE-2026-56746) * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [rhboac-camel-quarkus-3] (CVE-2026-56745) * netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [rhboac-camel-quarkus-3] (CVE-2026-55851) * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [rhboac-camel-quarkus-3] (CVE-2026-55831) * vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation [rhboac-camel-quarkus-3] (CVE-2026-15076) * smallrye-mutiny-vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [rhboac-camel-quarkus-3] (CVE-2026-15075) * vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [rhboac-camel-quarkus-3] (CVE-2026-15075) * httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks [rhboac-camel-quarkus-3] (CVE-2026-54428) * camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data [rhboac-camel-quarkus-3] (CVE-2026-40859) * camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers [rhboac-camel-quarkus-3] (CVE-2026-46584) * camel-cxf-common: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation [rhboac-camel-quarkus-3] (CVE-2026-46592) * camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure [rhboac-camel-quarkus-3] (CVE-2026-46726) * httpcore: Apache HttpComponents Core: Denial of Service via excessive HTTP headers [rhboac-camel-quarkus-3] (CVE-2026-54399)
AI Analysis
Technical Summary
This security advisory covers a set of vulnerabilities fixed in Red Hat build of Quarkus 3.33.2.SP3 and Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33. The vulnerabilities include denial of service via memory exhaustion and protocol misuse in Netty components (e.g., netty-codec-http, netty-codec-http2, netty-codec-haproxy), information disclosure via improper HTTP redirect and cookie domain validation in Vert.x components, remote code execution via deserialization in Apache Camel's camel-vertx-http, and security bypass via null origin headers in Netty. The update addresses CVEs such as CVE-2026-15075, CVE-2026-56746, CVE-2026-40859, CVE-2026-59899, among others. The advisory includes detailed references and instructions for applying the update.
Potential Impact
The vulnerabilities fixed by this update could allow attackers to cause denial of service conditions through memory exhaustion or protocol misuse, disclose sensitive information via improper validation of HTTP redirects and cookies, bypass security controls to send unauthorized requests, and execute remote code through deserialization of untrusted data. These issues affect critical components used in the Red Hat build of Quarkus and Apache Camel, potentially impacting the security and stability of applications relying on these runtimes.
Mitigation Recommendations
Red Hat has released an official security update for Red Hat build of Quarkus 3.33.2.SP3 and Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 that addresses all listed vulnerabilities. Users should apply this update promptly after backing up their existing installations, including applications, configuration files, and databases. Detailed update instructions are available in the Red Hat advisory. No additional mitigation steps are required beyond applying the official update.
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
Description
An update for Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3). The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products: * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [rhboac-camel-quarkus-3] (CVE-2026-59899) * netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [rhboac-camel-quarkus-3] (CVE-2026-56819) * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [rhboac-camel-quarkus-3] (CVE-2026-56746) * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [rhboac-camel-quarkus-3] (CVE-2026-56745) * netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [rhboac-camel-quarkus-3] (CVE-2026-55851) * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [rhboac-camel-quarkus-3] (CVE-2026-55831) * vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation [rhboac-camel-quarkus-3] (CVE-2026-15076) * smallrye-mutiny-vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [rhboac-camel-quarkus-3] (CVE-2026-15075) * vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [rhboac-camel-quarkus-3] (CVE-2026-15075) * httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks [rhboac-camel-quarkus-3] (CVE-2026-54428) * camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data [rhboac-camel-quarkus-3] (CVE-2026-40859) * camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers [rhboac-camel-quarkus-3] (CVE-2026-46584) * camel-cxf-common: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation [rhboac-camel-quarkus-3] (CVE-2026-46592) * camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure [rhboac-camel-quarkus-3] (CVE-2026-46726) * httpcore: Apache HttpComponents Core: Denial of Service via excessive HTTP headers [rhboac-camel-quarkus-3] (CVE-2026-54399)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This security advisory covers a set of vulnerabilities fixed in Red Hat build of Quarkus 3.33.2.SP3 and Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33. The vulnerabilities include denial of service via memory exhaustion and protocol misuse in Netty components (e.g., netty-codec-http, netty-codec-http2, netty-codec-haproxy), information disclosure via improper HTTP redirect and cookie domain validation in Vert.x components, remote code execution via deserialization in Apache Camel's camel-vertx-http, and security bypass via null origin headers in Netty. The update addresses CVEs such as CVE-2026-15075, CVE-2026-56746, CVE-2026-40859, CVE-2026-59899, among others. The advisory includes detailed references and instructions for applying the update.
Potential Impact
The vulnerabilities fixed by this update could allow attackers to cause denial of service conditions through memory exhaustion or protocol misuse, disclose sensitive information via improper validation of HTTP redirects and cookies, bypass security controls to send unauthorized requests, and execute remote code through deserialization of untrusted data. These issues affect critical components used in the Red Hat build of Quarkus and Apache Camel, potentially impacting the security and stability of applications relying on these runtimes.
Mitigation Recommendations
Red Hat has released an official security update for Red Hat build of Quarkus 3.33.2.SP3 and Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 that addresses all listed vulnerabilities. Users should apply this update promptly after backing up their existing installations, including applications, configuration files, and databases. Detailed update instructions are available in the Red Hat advisory. No additional mitigation steps are required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:47189
- Cve Count
- 13
- Additional Cves
- ["CVE-2026-15076","CVE-2026-16308","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59898","CVE-2026-59899","CVE-2026-59900","CVE-2026-59921"]
- State
- PUBLISHED
Threat ID: 6a6ae5429c2644c7f8987aaa
Added to database: 07/30/2026, 05:46:42 UTC
Last enriched: 08/17/2026, 21:56:22 UTC
Last updated: 09/12/2026, 10:01:29 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.