This security update for Red Hat build of Apache Camel 4.18 for Quarkus 3.33 addresses multiple Important-severity vulnerabilities, including denial of service via memory leaks in Netty's HAProxy and HTTP/2 codecs (CVE-2026-48059, CVE-2026-48043), hostname verification bypass in Netty's TLS handler (CVE-2026-50010), and an authentication/authorization bypass in Quarkus Vert.x HTTP via path normalization flaws (CVE-2026-50559). The advisory provides fixes for these and several other CVEs affecting Netty, Apache Thrift, and Quarkus components within this specific build. Organizations should apply the referenced update after backing up their existing installations.
Red Hat Product Errata RHSA-2026:26586 - Security Advisory Issued: 2026-06-17 Updated: 2026-06-17 RHSA-2026:26586 - Security Advisory Overview Synopsis Important: Red Hat build of Apache Camel 4.18 for Quarkus 3.33 security update Type/Severity Security Advisory: Important Topic A security update for Red Hat build of Apache Camel 4.18 for Quarkus 3.33 is now available. This text-only errata provides information about enhancements that improve your developer experience and ensure the security and stability of your applications. Red Hat Product Security has rated this update as having a security impact of Important. Description A security update for Red Hat build of Apache Camel 4.18 for Quarkus 3.33 is now available and includes the following CVE fixes: netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [rhboac-camel-quarkus-3] (CVE-2026-45416) netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation [rhboac-camel-quarkus-3] (CVE-2026-45674) netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [rhboac-camel-quarkus-3] (CVE-2026-50010) netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records [rhboac-camel-quarkus-3] (CVE-2026-47691) netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers [rhboac-camel-quarkus-3] (CVE-2026-48059) netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak [rhboac-camel-quarkus-3] (CVE-2026-48043) netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message [rhboac-camel-quarkus-3] (CVE-2026-44893) netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [rhboac-camel-quarkus-3] (CVE-2026-44249) quarkus-vertx- http: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities [rhboac-camel-quarkus-3] (CVE-2026-50559) libthrift: Apache Thrift: Denial of Service via excessive memory allocation [rhboac-camel-quarkus-3] (CVE-2026-43868) libthrift: Apache Thrift: Security bypass due to improper certificate validation [rhboac-camel-quarkus-3] (CVE-2026-43869) Solution Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Affected Products Red Hat Build of Apache Camel 1 x86_64 Fixes BZ - 2466660 - CVE-2026-43869 Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation BZ - 2466670 - CVE-2026-43868 Apache Thrift: Apache Thrift: Denial of Service via excessive memory allocation BZ - 2488081 - CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation CVEs CVE-2026-43868 CVE-2026-43869 CVE-2026-44249 CVE-2026-44893 CVE-2026-45416 CVE-2026-45674 CVE-2026-47691 CVE-2026-48043 CVE-2026-48059 CVE-2026-50010 CVE-2026-50559 References https://access.redhat.com/security/updates/classification/#important The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .