Threats Tagged 'cve-2026-42583'

Red Hat build of Apache Camel 4.18.3 for Spring Boot patch release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193) * c3p0: c3p0: Remote code execution via deserialization vulnerability (CVE-2026-55223) * mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection (CVE-2026-55153) * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * httpcore: Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399) * camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection (CVE-2026-43866) * camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure (CVE-2026-46726) * camel-cxf-common: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation (CVE-2026-46592) * camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers (CVE-2026-46584) * camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data (CVE-2026-40859) * httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428) * httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399) * commons-configuration2: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input (CVE-2026-45205) * netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder (CVE-2026-44891) * vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076) * netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833) * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831) * netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851) * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745) * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746) * netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability (CVE-2026-56817) * netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819) * netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack (CVE-2026-56820) * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (CVE-2026-59899)

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) * jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595) * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828) * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681) * golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385) * net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * form-data: Form field override via CRLF injection (CVE-2026-12143) * ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779) * ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736) * undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625) * brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * protobufjs: Denial of Service via crafted schema (CVE-2026-44290) * protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292) * protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740) * protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) * jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595) * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828) * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681) * golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385) * net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * form-data: Form field override via CRLF injection (CVE-2026-12143) * ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779) * ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736) * undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625) * brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * protobufjs: Denial of Service via crafted schema (CVE-2026-44290) * protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292) * protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740) * protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities have been identified in the Apache Zookeeper package, specifically affecting version 3.8.6-r1. These issues involve the Netty network application framework used by Zookeeper. Security fixes addressing CVE-2026-42583 and related vulnerabilities have been applied in versions 3.8.6-r0 and 3.8.6-r1.

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 3.2.0 serves as a replacement for Red Hat Streams for Apache Kafka 3.1.0, and includes security and bug fixes, and enhancements. Security Fix(es): * Drain Cleaner, Kafks Exporter - Eclipse Vert.x Web static handler file access denial [amq-st-3.2]"(CVE-2026-1002)" * Drain Cleaner, Kroxylicous - Netty denial of service[amqst-3.2]"(CVE-2026-33871)" * Drain Cleaner, Kroxylicous - Netty request smuggling attacks[amqst-3.2]"(CVE-2026-33870)" * Cruise Control - jose4j denial of service [amqst-3.2]"(CVE-2024-29371)" * Kafka Exporter - golang-github-danielqsj-kafka_exporter: Memory exhaustion in query parameter parsing in net/url [amq-st-3.2]"(CVE-2025-61726)" * Kafka Exporter - golang-github-danielqsj-kafka_exporter: golang: Denial of Service due to excessive resource consumption via crafted certificate [amq-st-3.2]"(CVE-2025-61729)" * Kafka Exporter - golang-github-danielqsj-kafka_exporter: Unexpected session resumption in crypto/tls [amqst-3.2]"(CVE-2025-68121)" * console UI - Next.js Server-Side Request Forgery in Server Actions [amqst-3.2]"(CVE-2024-34351)" * console UI - com.github.streamshub-console: Next.js: Unbounded next/image disk cache growth can exhaust storage[amqst-3.2]"(CVE-2026-27980)" * console UI - Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization [amqst-3.2]"(CVE-2025-62718)" * console UI - React Server Components: Denial of Service via specially crafted HTTP requests [amqst-3.2]"(CVE-2026-23864)" * console UI - Axios: Remote Code Execution via Prototype Pollution escalation [amqst-3.2]"(CVE-2026-40175)" * console UI - lodash: Arbitrary code execution via untrusted input in template imports [amqst-3.2]"(CVE-2026-4800)"