SB2026083157 - Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate non-allowlisted types.
The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.
The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate arbitrary classes.
The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.
Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.
3) Input validation error (CVE-ID: CVE-2026-40983)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ObservationGrpcServerInterceptor when handling specially crafted gRPC requests. A remote attacker can send a specially crafted gRPC request to cause a denial of service.
The issue is exposed only when observations are recorded and metrics are output through DefaultMeterObservationHandler or a similarly behaving custom ObservationHandler.
4) Input validation error (CVE-ID: CVE-2026-40984)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in HTTP server instrumentations when handling specially crafted HTTP requests. A remote attacker can send a specially crafted HTTP request to cause a denial of service.
The issue affects applications only when one or more HTTP server instrumentations are configured and metrics are recorded through the instrumentation.
5) XML External Entity injection (CVE-ID: CVE-2026-49875)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper restriction of XML external entity reference in W3CMultiSchemaFactory and EndpointReferenceUtils when parsing XML input. A remote attacker can supply crafted XML containing external entity references to disclose sensitive information.
The issue enables out-of-band external entity resolution.
Remediation
Install update from vendor's website.