Apache Camel Quarkus (Redhat) - vulnerabilities (CVEs)

41 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-09-18. Vendor: Redhat.

CVEs of Apache Camel Quarkus

CVE-2026-93568 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's…
CVE-2026-93569 - CVSS 8.2 (high), 2026-09-18: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1…
CVE-2026-93567 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the…
CVE-2026-93565 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time…
CVE-2026-93564 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted…
CVE-2026-93558 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to…
CVE-2026-93491 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single…
CVE-2026-93488 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to…
CVE-2026-17615 - CVSS 7.5 (high), 2026-08-31: A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By…
CVE-2026-12894 - CVSS 8.8 (high), 2026-08-31: A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the…
CVE-2026-19611 - CVSS 7.4 (high), 2026-08-20: A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII…
CVE-2026-54513 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
CVE-2026-50559 - CVSS 7.5 (high), 2026-06-19: Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2,…
CVE-2026-50010 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-48059 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY…
CVE-2026-48043 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and…
CVE-2026-47691 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-45674 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-45416 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-44893 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and…
CVE-2026-49875 - CVSS 9.8 (critical), 2026-06-12: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations,…
CVE-2026-44249 - CVSS 8.1 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-40984 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2026-40983 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2026-39852 - CVSS 8.8 (high), 2026-05-05: Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path…
CVE-2026-43868 - CVSS 7.5 (high), 2026-05-05: Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade…
CVE-2026-43869 - CVSS 7.3 (high), 2026-05-05: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended…
CVE-2026-40858 - CVSS 8.8 (high), 2026-04-27: The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using…
CVE-2026-33454 - CVSS 9.4 (critical), 2026-04-27: The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy)…
CVE-2026-40453 - CVSS 9.9 (critical), 2026-04-27: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are…
CVE-2026-40860 - CVSS 9.8 (critical), 2026-04-27: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values…
CVE-2026-6857 - CVSS 7.5 (high), 2026-04-22: A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker…
CVE-2026-5588 - CVSS 7.5 (high), 2026-04-15: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy…
CVE-2026-3505 - CVSS 8.7 (high), 2026-04-15: Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all…
CVE-2025-14813 - CVSS 9.3 (critical), 2026-04-15: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability…
CVE-2026-0636 - CVSS 6.5 (medium), 2026-04-15: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all…
CVE-2026-2332 - CVSS 9.1 (critical), 2026-04-14: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined…
CVE-2026-33871 - CVSS 8.7 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial…
CVE-2026-33870 - CVSS 7.5 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted…
CVE-2024-1300 - CVSS 5.4 (medium), 2024-04-02: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server…
CVE-2024-1023 - CVSS 6.5 (medium), 2024-03-27: A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP…