Camel Spring Boot (Redhat) - vulnerabilities (CVEs)

83 CVEs, 1 in the last 30 days, 2 known versions, newest CVE from 2026-10-21. Vendor: Redhat.

CVEs of Camel Spring Boot

CVE-2026-114370 - CVSS 3.7 (low), 2026-10-21: A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system.…
CVE-2026-93562 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request…
CVE-2026-93574 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1…
CVE-2026-93579 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage…
CVE-2026-93573 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the…
CVE-2026-93568 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's…
CVE-2026-93576 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP…
CVE-2026-93569 - CVSS 8.2 (high), 2026-09-18: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1…
CVE-2026-93567 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the…
CVE-2026-93566 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the…
CVE-2026-93565 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time…
CVE-2026-93564 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted…
CVE-2026-93558 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to…
CVE-2026-93560 - CVSS 7.5 (high), 2026-09-18: A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum…
CVE-2026-93492 - CVSS 5.3 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE.…
CVE-2026-93491 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single…
CVE-2026-93488 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to…
CVE-2026-93563 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit…
CVE-2026-93578 - CVSS 5.9 (medium), 2026-09-18: A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in…
CVE-2026-93572 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis…
CVE-2026-93575 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet.…
CVE-2026-93561 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types…
CVE-2026-93493 - CVSS 5.9 (medium), 2026-09-18: A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status…
CVE-2026-93494 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body…
CVE-2026-86404 - CVSS 8.8 (high), 2026-09-07: EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which…
CVE-2026-84218 - CVSS 8.1 (high), 2026-09-01: A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist…
CVE-2026-81624 - CVSS 7.5 (high), 2026-08-31: Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically,…
CVE-2026-5680 - CVSS 7.5 (high), 2026-08-27: A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate…
CVE-2026-19879 - CVSS 5.3 (medium), 2026-08-14: A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from…
CVE-2026-14180 - CVSS 5.3 (medium), 2026-08-11: A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The…
CVE-2026-15565 - CVSS 7.5 (high), 2026-08-11: A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has…
CVE-2026-48779 - CVSS 7.5 (high), 2026-06-16: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up…
CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
CVE-2026-44492 - CVSS 8.6 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When…
CVE-2026-44496 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a…
CVE-2026-44495 - CVSS 7.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in…
CVE-2026-44494 - CVSS 8.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution…
CVE-2026-44486 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a…
CVE-2026-44488 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size…
CVE-2026-44487 - CVSS 8.2 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization…
CVE-2026-40983 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2026-47323 - CVSS 9.8 (critical), 2026-05-19: Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations…
CVE-2026-45736 - CVSS 7.5 (high), 2026-05-15: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory…
CVE-2026-42338 - CVSS 8.1 (high), 2026-05-12: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not…
CVE-2026-42264 - CVSS 9.1 (critical), 2026-05-08: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL,…
CVE-2026-42027 - CVSS 9.8 (critical), 2026-05-04: Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3…
CVE-2026-40682 - CVSS 9.1 (critical), 2026-05-04: XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3…
CVE-2026-40976 - CVSS 9.1 (critical), 2026-04-28: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be…
CVE-2026-27172 - CVSS 8.8 (high), 2026-04-27: The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)…
CVE-2026-33454 - CVSS 9.4 (critical), 2026-04-27: The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy)…
CVE-2026-40473 - CVSS 8.8 (high), 2026-04-27: The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any…
CVE-2026-40048 - CVSS 7.8 (high), 2026-04-27: The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using…
CVE-2026-40542 - CVSS 7.3 (high), 2026-04-22: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper…
CVE-2026-22754 - CVSS 7.5 (high), 2026-04-22: Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet…
CVE-2026-22747 - CVSS 8.1 (high), 2026-04-22: Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead…
CVE-2026-33557 - CVSS 9.1 (critical), 2026-04-20: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to…
CVE-2026-40478 - CVSS 9.1 (critical), 2026-04-17: Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability…
CVE-2026-40477 - CVSS 9.1 (critical), 2026-04-17: Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability…
CVE-2026-5598 - CVSS 8.9 (high), 2026-04-15: Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program…
CVE-2026-39304 - CVSS 7.5 (high), 2026-04-10: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not…
CVE-2026-28369 - CVSS 9.1 (critical), 2026-03-27: A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the…
CVE-2026-28368 - CVSS 9.1 (critical), 2026-03-27: A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by…
CVE-2026-28367 - CVSS 9.1 (critical), 2026-03-27: A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request…
CVE-2026-24281 - CVSS 7.4 (high), 2026-03-07: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof…
CVE-2026-24308 - CVSS 7.5 (high), 2026-03-07: Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information…
CVE-2026-1605 - CVSS 7.5 (high), 2026-03-05: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding:…
CVE-2026-25747 - CVSS 8.8 (high), 2026-02-23: Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read…
CVE-2025-69873 - CVSS 7.5 (high), 2026-02-11: ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern…
CVE-2025-70974 - CVSS 10 (critical), 2026-01-09: Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may…
CVE-2024-3884 - CVSS 7.5 (high), 2025-12-03: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel)…
CVE-2023-4639 - CVSS 7.4 (high), 2024-11-17: A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an…
CVE-2024-7885 - CVSS 7.5 (high), 2024-08-21: A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs…
CVE-2024-3653 - CVSS 5.3 (medium), 2024-07-08: A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving…
CVE-2024-5971 - CVSS 7.5 (high), 2024-07-08: A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client…
CVE-2024-6162 - CVSS 7.5 (high), 2024-06-20: A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises…
CVE-2024-1300 - CVSS 5.4 (medium), 2024-04-02: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server…
CVE-2024-1023 - CVSS 6.5 (medium), 2024-03-27: A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP…
CVE-2023-5685 - CVSS 7.5 (high), 2024-03-22: A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can…
CVE-2024-1635 - CVSS 7.5 (high), 2024-02-19: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and…
CVE-2023-5236 - CVSS 6.5 (medium), 2023-12-18: A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions…
CVE-2022-4245 - CVSS 4.3 (medium), 2023-09-25: A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue…
CVE-2022-4244 - CVSS 7.5 (high), 2023-09-25: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the…
CVE-2022-1415 - CVSS 8.8 (high), 2023-09-11: A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker…