Vulnerabilities of Red Hat Red Hat build of Apache Camel for Spring Boot 4

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-42027	Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5,…	Not rated	May 4, 2026
CVE-2026-40976	In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…	9.1 Critical	Apr 27, 2026
CVE-2026-27172	The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner…	Not rated	Apr 27, 2026
CVE-2026-33454	The Camel-Mail component is vulnerable to Camel message header injection	Not rated	Apr 27, 2026
CVE-2026-40048	The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key…	Not rated	Apr 27, 2026
CVE-2026-40473	The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a…	Not rated	Apr 27, 2026
CVE-2026-6857	A flaw was found in camel-infinispan	7.5 High	Apr 22, 2026
CVE-2026-40542	Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept…	Not rated	Apr 22, 2026
CVE-2026-22754	Vulnerability in Spring Spring Security	7.5 High	Apr 22, 2026
CVE-2026-22747	Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509…	6.8 Medium	Apr 22, 2026
CVE-2026-33557	A possible security vulnerability has been identified in Apache Kafka	Not rated	Apr 20, 2026
CVE-2026-40478	Thymeleaf is a server-side Java template engine for web and standalone environments	9.1 Critical	Apr 17, 2026
CVE-2026-40477	Thymeleaf is a server-side Java template engine for web and standalone environments	9.1 Critical	Apr 17, 2026
CVE-2026-5598	Covert timing channel vulnerability in Legion of the Bouncy Castle Inc	8.9 High	Apr 15, 2026
CVE-2026-39304	Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ	Not rated	Apr 10, 2026
CVE-2026-28367	Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator	8.7 High	Mar 27, 2026
CVE-2026-28369	Undertow: undertow: request smuggling via malformed http request headers	8.7 High	Mar 27, 2026
CVE-2026-28368	Undertow: undertow: request smuggling via inconsistent header parsing	8.7 High	Mar 27, 2026
CVE-2026-3260	A flaw was found in Undertow	5.9 Medium	Mar 24, 2026
CVE-2026-24308	Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an…	Not rated	Mar 7, 2026
CVE-2026-24281	Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails,…	Not rated	Mar 7, 2026
CVE-2026-1605	In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed…	7.5 High	Mar 5, 2026
CVE-2026-25747	Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component	Not rated	Feb 23, 2026
CVE-2025-69873	ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the…	2.9 Low	Feb 11, 2026
CVE-2024-4027	Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks	7.5 High	Jan 30, 2026

Other Red Hat products