SB20260825112 - Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-42403)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the policy normalization process when parsing WS-Policy documents containing circular policy references. A remote attacker can supply a specially crafted policy document to cause a denial of service.
The issue can result in an infinite loop, excessive recursion, a stack overflow, or an application hang.
2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-42404)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access internal network resources.
The vulnerability exists due to improper input validation in the PolicyReference API when fetching remote policy references from user-supplied URIs. A remote attacker can supply a crafted URI to access internal network resources.
Exploitation requires an application to explicitly call the API to retrieve a policy from a remote URI.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42402)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to unbounded resource allocation in policy normalization when parsing specially crafted WS-Policy documents. A remote attacker can send a specially crafted WS-Policy document to cause a denial of service.
The issue can exhaust the JVM heap during normalization because an exponential Cartesian cross-product expansion generates an excessive number of policy alternatives.
4) Input validation error (CVE-ID: CVE-2026-40453)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code or write arbitrary files.
The vulnerability exists due to improper input validation in non-HTTP HeaderFilterStrategy implementations when processing broker messages with case-variant Camel internal headers. A remote user can inject crafted headers to execute arbitrary code or write arbitrary files.
Exploitation requires producer access to a JMS or equivalent broker consumed by a Camel route, and affects routes that forward messages to header-driven components such as camel-exec or camel-file.
5) Input validation error (CVE-ID: CVE-2026-33454)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in MailHeaderFilterStrategy when consuming mail messages through camel-mail. A remote attacker can send an email with crafted Camel-prefixed MIME headers to alter downstream route behavior and execute arbitrary code.
Exploitation requires the application to consume email from a monitored mailbox and use downstream components that act on injected Camel headers, such as camel-bean, camel-exec, or camel-sql.
Remediation
Install update from vendor's website.