Loading story…
Red Hat released RHSA-2026:25089 for HawtIO 4.4.0 in the Red Hat build of Apache Camel 4, shipping an Important-rated security update that fixes a broad set of vulnerabilities across bundled components. The advisory covers issues in Spring Boot, axios, Jetty, Quarkus Vert.x HTTP, Vert.x Core, fast-uri, lodash-related HawtIO code, and Go libraries used by the hawtio-operator-container, with impacts ranging from remote and arbitrary code execution to authentication and authorization bypass, path traversal, prototype pollution, denial of service, certificate validation bypass, information disclosure, and session hijacking.
A key issue addressed is CVE-2026-2332, an Important-severity HTTP request smuggling flaw in Eclipse Jetty caused by improper handling of chunk extensions with an unclosed double quote before CRLF. Red Hat said a remote attacker could exploit Jetty servers deployed behind reverse proxies or load balancers to bypass security controls, poison caches, or reach unauthorized endpoints, and noted no practical mitigation beyond updating affected packages. Red Hat listed fixes across multiple products, including HawtIO, Red Hat AMQ Broker, Red Hat build of Apache Camel, Red Hat Enterprise Linux 9, and several Red Hat Satellite releases, and urged customers to apply the relevant errata.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat published its CVE page for CVE-2026-2332, describing an Important Jetty HTTP/1.1 request smuggling flaw involving malformed chunk extensions and stating no practical mitigation was identified. The page also listed HawtIO 4.4.0 as fixed in RHSA-2026:25089 and advised customers to update affected packages promptly.
Red Hat published security advisory RHSA-2026:25089 for HawtIO 4.4.0 in the Red Hat build of Apache Camel 4, rated Important. The advisory announced the GA security update and bundled fixes for numerous vulnerabilities across Spring Boot, axios, Jetty, Quarkus Vert.x HTTP, Vert.x Core, HawtIO code, and Go libraries.
Red Hat listed Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 as fixed for CVE-2026-2332 in RHSA-2026:22453. The advisory tied this product update to remediation of the Jetty request smuggling issue.
Red Hat listed Red Hat Enterprise Linux 9 with component jmc as fixed for CVE-2026-2332 in RHSA-2026:20568. This was one of the product-specific remediations for the Jetty parser flaw.
Red Hat listed Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 as fixed for CVE-2026-2332 in RHSA-2026:17668. The affected component was jetty-http.
Red Hat listed Red Hat AMQ Broker 7.13.5 as fixed for CVE-2026-2332 in security advisory RHSA-2026:14272. The fix addressed the Jetty HTTP request smuggling flaw in that product line.
Red Hat listed Red Hat Satellite 6.16, 6.17, 6.18, and 6.19 releases for RHEL 8 and 9 with openvox-server as fixed for CVE-2026-2332 through RHSA-2026:50221, RHSA-2026:50222, RHSA-2026:50223, and RHSA-2026:50263. These advisories extended remediation of the Jetty flaw to Satellite product lines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates for its Apache Camel distributions for **Spring Boot** and **Quarkus** to fix multiple vulnerabilities, including **remote code execution** and arbitrary code execution flaws tied to unsafe deserialization. Advisory `RHSA-2026:17668` updates **Red Hat Build of Apache Camel 4.18.1 for Spring Boot**, while `RHSA-2026:22453` updates **Red Hat Build of Apache Camel 4.18 for Quarkus 3.33** to `3.33.1.GA`. The advisories also address additional high-impact issues across bundled components such as **Jetty**, **Netty**, **Apache Artemis**, **Kafka Clients**, **Bouncy Castle**, **Plexus Utils**, and **Apache MINA**, covering risks including authentication bypass, request smuggling, denial of service, directory traversal, arbitrary file write, and information disclosure.
Aug 20, 2026
Red Hat released **Important** security updates for **Red Hat AMQ Broker 7.12.7** and **7.13.5**, addressing multiple vulnerabilities in bundled components including **Bouncy Castle**, **Netty**, and **Apache ZooKeeper**. The advisories cover issues such as **LDAP injection** in BC-JAVA (`CVE-2026-0636`), **HTTP request smuggling** and **HTTP/2 denial of service** in Netty, and ZooKeeper flaws that could enable **information disclosure** and **reverse-DNS-spoofing-based impersonation**. Red Hat told customers to back up existing installations before applying the fixed releases from the Customer Portal. The updates also remediate a Bouncy Castle cryptographic flaw, `CVE-2025-14813`, in the **GOSTCTR** implementation, where keystream reuse after more than 255 blocks under the same key and IV can allow plaintext recovery from captured ciphertext. Red Hat rated that issue **Important** with a **CVSS 7.5** score and advised limiting encrypted payloads to 255 blocks per key/IV pair or moving to a stronger authenticated encryption mode until patched. The underlying weakness aligns with **CWE-327**, which covers the use of broken or risky cryptographic algorithms that can expose sensitive data and undermine system trust.
Aug 20, 2026
Red Hat released **Important** security updates for `httpd:2.4` across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, **CVE-2025-55753** and **CVE-2025-58098**. The first flaw affects `mod_md` ACME certificate renewal handling in Apache HTTP Server versions `2.4.30` through `2.4.65`, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before `2.4.66` when **Server Side Includes** is enabled with `mod_cgid`, causing the shell-escaped query string to be passed to SSI `#exec cmd="..."` directives. The fixes were shipped through advisories including **RHSA-2026:0009**, **RHSA-2026:0010**, **RHSA-2026:0011**, and **RHSA-2026:0012**, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include `httpd`, `mod_md`, `mod_http2`, `mod_ssl`, `mod_ldap`, `mod_proxy_html`, and `mod_session` for supported architectures, while Apache identified version `2.4.66` as the upstream fix level for both issues.
Aug 21, 2026