SB20260825114 - Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-45416)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in SslClientHelloHandler.decode() when processing a TLS ClientHello that does not fit in the first record. A remote attacker can send a specially crafted ClientHello with a large handshake length to cause a denial of service.
The issue is exposed by the commonly used SniHandler and AbstractSniHandler constructors because they disable the client hello length guard and do not schedule a handshake timeout.
2) Insufficient verification of data authenticity (CVE-ID: CVE-2026-45674)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to insufficient verification of data authenticity in DnsResolveContext buildAliasMap when processing CNAME records in DNS responses. A remote attacker can send a malicious DNS response containing out-of-bailiwick CNAME records to poison the DNS cache.
Any application using Netty's DNS resolver is impacted.
3) Improper Certificate Validation (CVE-ID: CVE-2026-50010)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.
The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-47691)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to insufficient verification of data authenticity in the DnsResolveContext.AuthoritativeNameServerList handling of NS records when processing DNS responses containing NS records in the AUTHORITY section and A records in the ADDITIONAL section. A remote attacker can provide crafted DNS records to poison the DNS cache.
Exploitation requires control of an authoritative name server for a subdomain, and the poisoned cache can affect future resolutions under the parent domain.
5) Memory leak (CVE-ID: CVE-2026-48059)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper memory management in the HAProxy PROXY protocol v2 codec when parsing syntactically valid headers containing nested PP2_TYPE_SSL TLVs. A remote attacker can send a specially crafted header to cause a denial of service.
The issue occurs on the successful parse path without throwing an exception, and the underlying pooled cumulation buffer remains pinned even if the application releases the HAProxyMessage normally.
6) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-48043)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a reference-count leak in DelegatingDecompressorFrameListener when processing HTTP/2 frames that cause the flow-controller to throw. A remote attacker can send crafted frames to cause a denial of service.
The issue may exhaust memory and eventually take down the JVM due to an out-of-memory error.
7) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-44893)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in HAProxyMessage.readNextTLV() when decoding a PP2_TYPE_SSL TLV with an invalid length. A remote attacker can send a specially crafted HAProxy TLV to cause a denial of service.
The issue is triggered when the TLV length is set below 5, causing an IndexOutOfBoundsException to propagate while a retained slice on the pooled cumulation buffer is not released.
8) Incorrect Comparison (CVE-ID: CVE-2026-44249)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.
The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.
The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.
9) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-50559)
CWE-ID: CWE-41 - Improper Resolution of Path Equivalence
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper resolution of path equivalence in AbstractPathMatchingHttpSecurityPolicy and static resource handlers when handling crafted request paths containing encoded semicolons, slashes, or backslashes. A remote attacker can send a specially crafted request to disclose sensitive information.
Path-based authorization policies can be bypassed via encoded semicolons on protected endpoints, while protected static resources can be exposed via encoded slashes, backslashes, or double-encoded path separators. REST endpoints using Quarkus REST are not affected by the encoded slash and backslash vectors because routing and security use the same normalized path.
10) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-43868)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in the Rust implementation when parsing input. A remote attacker can send specially crafted input to cause a denial of service.
11) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-43869)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to spoof a trusted server.
The vulnerability exists due to improper validation of certificate with host mismatch in TSSLTransportFactory.java when establishing TLS connections. A remote attacker can present a certificate for a different host to spoof a trusted server.
Remediation
Install update from vendor's website.