Apache Camel Spring Boot (Redhat) - vulnerabilities (CVEs)

57 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2026-06-23. Vendor: Redhat.

CVEs of Apache Camel Spring Boot

• CVE-2026-54513 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
• CVE-2026-50011 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-50010 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-48059 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY…
• CVE-2026-48043 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and…
• CVE-2026-48006 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the…
• CVE-2026-47691 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
• CVE-2026-46340 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and…
• CVE-2026-45674 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
• CVE-2026-44893 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and…
• CVE-2026-45416 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-50633 - CVSS 8.1 (high), 2026-06-12: A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to…
• CVE-2026-50632 - CVSS 8.8 (high), 2026-06-12: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can…
• CVE-2026-50628 - CVSS 9.8 (critical), 2026-06-12: A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP…
• CVE-2026-50627 - CVSS 9.1 (critical), 2026-06-12: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one…
• CVE-2026-49875 - CVSS 9.8 (critical), 2026-06-12: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations,…
• CVE-2026-44890 - CVSS 7.5 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and…
• CVE-2026-44250 - CVSS 7.5 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and…
• CVE-2026-44249 - CVSS 8.1 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-40984 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions:…
• CVE-2026-44417 - CVSS 7.5 (high), 2026-05-22: The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code…
• CVE-2026-44930 - CVSS 9.8 (critical), 2026-05-22: An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates…
• CVE-2026-44248 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed…
• CVE-2026-42587 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation…
• CVE-2026-42584 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response…
• CVE-2026-42579 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035…
• CVE-2026-42578 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP…
• CVE-2026-42581 - CVSS 9.8 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…
• CVE-2026-40975 - CVSS 8.2 (high), 2026-04-28: Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used…
• CVE-2026-33453 - CVSS 10 (critical), 2026-04-27: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap…
• CVE-2026-40858 - CVSS 8.8 (high), 2026-04-27: The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using…
• CVE-2026-40022 - CVSS 8.2 (high), 2026-04-27: When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path…
• CVE-2026-33454 - CVSS 9.4 (critical), 2026-04-27: The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy)…
• CVE-2026-40860 - CVSS 9.8 (critical), 2026-04-27: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values…
• CVE-2026-40453 - CVSS 9.9 (critical), 2026-04-27: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are…
• CVE-2026-6857 - CVSS 7.5 (high), 2026-04-22: A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker…
• CVE-2026-5588 - CVSS 7.5 (high), 2026-04-15: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy…
• CVE-2026-3505 - CVSS 8.7 (high), 2026-04-15: Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all…
• CVE-2026-0636 - CVSS 6.5 (medium), 2026-04-15: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all…
• CVE-2025-14813 - CVSS 9.3 (critical), 2026-04-15: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability…
• CVE-2026-2332 - CVSS 9.1 (critical), 2026-04-14: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined…
• CVE-2026-5795 - CVSS 7.4 (high), 2026-04-08: In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial…
• CVE-2026-33871 - CVSS 8.7 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial…
• CVE-2026-33870 - CVSS 7.5 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted…
• CVE-2025-67030 - CVSS 8.8 (high), 2026-03-25: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before…
• CVE-2026-27446 - CVSS 9.8 (critical), 2026-03-04: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use…
• CVE-2026-27830 - CVSS 8.9 (high), 2026-02-26: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances.…
• CVE-2026-27727 - CVSS 9.8 (critical), 2026-02-25: mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for…
• CVE-2025-12543 - CVSS 9.6 (critical), 2026-01-07: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly…
• CVE-2025-9784 - CVSS 7.5 (high), 2025-09-02: A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to…
• CVE-2025-2240 - CVSS 7.5 (high), 2025-03-12: A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when…
• CVE-2024-7885 - CVSS 7.5 (high), 2024-08-21: A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs…
• CVE-2024-5971 - CVSS 7.5 (high), 2024-07-08: A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client…
• CVE-2024-6162 - CVSS 7.5 (high), 2024-06-20: A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises…
• CVE-2024-1300 - CVSS 5.4 (medium), 2024-04-02: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server…
• CVE-2024-1023 - CVSS 6.5 (medium), 2024-03-27: A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP…
• CVE-2024-1635 - CVSS 7.5 (high), 2024-02-19: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and…