Loading story…
Red Hat released security updates for its Apache Camel distributions for Spring Boot and Quarkus to fix multiple vulnerabilities, including remote code execution and arbitrary code execution flaws tied to unsafe deserialization. Advisory RHSA-2026:17668 updates Red Hat Build of Apache Camel 4.18.1 for Spring Boot, while RHSA-2026:22453 updates Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 to 3.33.1.GA. The advisories also address additional high-impact issues across bundled components such as Jetty, Netty, Apache Artemis, Kafka Clients, Bouncy Castle, Plexus Utils, and Apache MINA, covering risks including authentication bypass, request smuggling, denial of service, directory traversal, arbitrary file write, and information disclosure.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat published security advisory RHSA-2026:22453 for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 and released update RHBQ 3.33.1.GA. The Important-rated update fixes CVE-2026-40858, CVE-2026-40860, CVE-2026-6857, and CVE-2026-2332 in bundled Apache Camel and Jetty components.
A Red Hat Bugzilla entry described CVE-2026-6857 as an unsafe deserialization flaw in camel-infinispan's ProtoStream remote aggregation repository and said the issue had been reported to the security team and to MITRE under CVE Request #2024308. The entry states Red Hat addressed the flaw in Red Hat Build of Apache Camel 4.18.1 for Spring Boot 3.5.14 and Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 via RHSA-2026:17668 and RHSA-2026:22453.
Red Hat published security advisory RHSA-2026:17668 announcing a patch release and security update for Red Hat Build of Apache Camel 4.18.1 for Spring Boot. The update fixes numerous vulnerabilities across Apache Camel, Spring Boot, Netty, Jetty, Apache Artemis, Kafka Clients, Bouncy Castle, Plexus Utils, and Apache MINA.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2026:25089** for **HawtIO 4.4.0** in the **Red Hat build of Apache Camel 4**, shipping an Important-rated security update that fixes a broad set of vulnerabilities across bundled components. The advisory covers issues in **Spring Boot**, **axios**, **Jetty**, **Quarkus Vert.x HTTP**, **Vert.x Core**, **fast-uri**, lodash-related HawtIO code, and Go libraries used by the `hawtio-operator-container`, with impacts ranging from remote and arbitrary code execution to authentication and authorization bypass, path traversal, prototype pollution, denial of service, certificate validation bypass, information disclosure, and session hijacking. A key issue addressed is **CVE-2026-2332**, an Important-severity HTTP request smuggling flaw in **Eclipse Jetty** caused by improper handling of chunk extensions with an unclosed double quote before `CRLF`. Red Hat said a remote attacker could exploit Jetty servers deployed behind reverse proxies or load balancers to bypass security controls, poison caches, or reach unauthorized endpoints, and noted no practical mitigation beyond updating affected packages. Red Hat listed fixes across multiple products, including **HawtIO**, **Red Hat AMQ Broker**, **Red Hat build of Apache Camel**, **Red Hat Enterprise Linux 9**, and several **Red Hat Satellite** releases, and urged customers to apply the relevant errata.
Aug 20, 2026
Red Hat released updates for its Quarkus distributions to remediate **CVE-2024-2700**, which can cause build-time `quarkus.*` environment settings from developer or CI systems to be embedded in deployed applications. Unsafe test settings—such as permissive TLS trust or database-drop behavior—could therefore reach production unless explicitly overridden. The fixes are available in Red Hat build of Quarkus **3.8.4** and **3.2.12**, and are also included in affected offerings such as AMQ Streams, RHOSS, HawtIO, and Apicurio Registry. The releases also address **CVE-2024-29025** in Netty `netty-codec-http`, where crafted chunked HTTP POST forms can force unbounded memory growth and cause denial of service. Red Hat’s Apicurio Registry 2.6.1 GA container-image update additionally fixes vulnerabilities in webpack-dev-middleware, Express, Jetty, and jose4j, including potential file disclosure and malformed-URL processing issues. Organizations should update affected Quarkus-based products and container images, applying prerequisite errata before deployment.
Aug 28, 2026
A deserialization vulnerability tracked as **`CVE-2026-25747`** affects the Apache Camel LevelDB component and can lead to arbitrary code execution. Red Hat rated the issue **Important** with a **CVSS v3 score of 7.8**, stating the flaw stems from Camel-LevelDB using **`java.io.ObjectInputStream`** to read LevelDB aggregation repository data without validation or class-loading restrictions. If an attacker can write a malicious serialized Java object into the LevelDB database files, the application may deserialize it and execute attacker-controlled code. Red Hat said no acceptable mitigation is currently available under its product security criteria. In its product status matrix, **Red Hat build of Apache Camel for Spring Boot 4** and **Red Hat Fuse 7** are marked **Will not fix**, while **Red Hat JBoss Enterprise Application Platform 8** and the **JBoss Enterprise Application Platform Expansion Pack** are listed as **Not affected** because the vulnerable component is not present. The issue is cataloged in the CVE program as **`CVE-2026-25747`**.
Aug 20, 2026