Loading story…
Red Hat released updates for its Quarkus distributions to remediate CVE-2024-2700, which can cause build-time quarkus.* environment settings from developer or CI systems to be embedded in deployed applications. Unsafe test settings—such as permissive TLS trust or database-drop behavior—could therefore reach production unless explicitly overridden. The fixes are available in Red Hat build of Quarkus 3.8.4 and 3.2.12, and are also included in affected offerings such as AMQ Streams, RHOSS, HawtIO, and Apicurio Registry.
The releases also address CVE-2024-29025 in Netty netty-codec-http, where crafted chunked HTTP POST forms can force unbounded memory growth and cause denial of service. Red Hat’s Apicurio Registry 2.6.1 GA container-image update additionally fixes vulnerabilities in webpack-dev-middleware, Express, Jetty, and jose4j, including potential file disclosure and malformed-URL processing issues. Organizations should update affected Quarkus-based products and container images, applying prerequisite errata before deployment.
See affected versions and whether adversaries are exploiting it.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2024:4873 for Red Hat build of Apicurio Registry 2.6.1 GA container images. The update fixed issues in webpack-dev-middleware, Express, Jetty, jose4j, and Quarkus Core, including CVE-2024-2700 configuration-property leakage.
Red Hat issued Important-rated RHSA-2024:4520 for Migration Toolkit for Containers 1.7.16 on RHEL 8 x86_64. The update remediated vulnerabilities in webpack-dev-middleware, Go components, and Envoy, including file-disclosure, memory/CPU exhaustion, and certificate-processing issues.
Red Hat issued Important-rated RHSA-2024:4460 for Red Hat Data Grid 8, upgrading version 8.4.8 to 8.5.0. The update fixed CVE-2024-29180, a webpack-dev-middleware file-disclosure flaw, and CVE-2024-29025, a Netty HTTP uncontrolled-resource-allocation issue.
Red Hat issued Important-rated RHSA-2024:2941 for Red Hat Advanced Cluster Security 4.4.2. The release addressed HTTP/2 CONTINUATION-frame denial of service and webpack-dev-middleware file-disclosure issues, while also fixing Collector crashes, Scanner false positives, network-graph failures, and stale-alert update problems.
Red Hat issued Moderate-severity advisory RHSA-2024:2705 for Red Hat build of Quarkus 3.2.12. It fixed CVE-2024-2700 in Quarkus Core and CVE-2024-29025 in Netty's netty-codec-http.
Red Hat issued RHSA-2024:2106 for Red Hat build of Quarkus 3.8.4, rated Moderate. The update remediated CVE-2024-2700, which could embed local Quarkus configuration properties in applications, and CVE-2024-29025, a Netty HTTP resource-exhaustion flaw.
Red Hat issued Important-rated RHSA-2024:1662 for Red Hat build of Quarkus 3.2.11. The update fixed seven CVEs, including SQL injection in the PostgreSQL JDBC driver, Quarkus Kubernetes annotation disclosure, RESTEasy Reactive denial of service, Apache Commons Compress denial-of-service flaws, and Vert.x memory leaks.
Red Hat issued Moderate-rated RHSA-2023:5441 for Red Hat Integration Camel for Spring Boot 4.0.0. The update fixed eight vulnerabilities in Apache Batik, Ivy, Jetty, Johnzon, and Netty, including SSRF, XXE, denial-of-service, cookie-disclosure, and HTTP/1 Content-Length validation issues.
Red Hat issued Important-rated RHSA-2023:5165 for Red Hat AMQ Streams 2.5.0 on RHEL 8. The update remediated 15 vulnerabilities, including SnakeYAML and Scala deserialization flaws, Netty, Jetty, Okio, and snappy-java denial-of-service issues, and insecure temporary-file creation vulnerabilities.
Red Hat documented CVE-2024-1300, in which Vert.x TLS TCP servers with SNI enabled retain default-certificate SSL contexts for arbitrary unknown SNI hostnames. An unauthenticated attacker could send repeated TLS ClientHello messages with distinct SNI values to exhaust JVM memory and cause denial of service; affected vertx-core versions span 4.3.4 through 4.5.2.
Red Hat published security advisory RHSA-2024:3527. The available reference does not provide a synopsis or technical details about affected products, vulnerabilities, or fixes.
Red Hat addressed CVE-2024-1023, a regression in Vert.x 4.4 and early 4.5 releases that can leak memory through Netty FastThreadLocal structures when the HTTP client connects to different hosts. The issue affected vertx-core 4.4.5, 4.4.6, 4.5.0, and 4.5.1 and was remediated through advisories for products including Quarkus, Cryostat, Service Registry, AMQ Streams, MTA, and Camel for Spring Boot.
Red Hat documented CVE-2023-34462, in which Netty's SniHandler could allocate up to 16 MB per TLS channel from attacker-crafted ClientHello data, enabling heap-memory exhaustion and denial of service. Netty fixed the flaw in 4.1.94.Final, and Red Hat issued updates for products including AMQ Streams, Data Grid, JBoss EAP, Quarkus, Service Registry, Cryostat, and Camel components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
15 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates for its Apache Camel distributions for **Spring Boot** and **Quarkus** to fix multiple vulnerabilities, including **remote code execution** and arbitrary code execution flaws tied to unsafe deserialization. Advisory `RHSA-2026:17668` updates **Red Hat Build of Apache Camel 4.18.1 for Spring Boot**, while `RHSA-2026:22453` updates **Red Hat Build of Apache Camel 4.18 for Quarkus 3.33** to `3.33.1.GA`. The advisories also address additional high-impact issues across bundled components such as **Jetty**, **Netty**, **Apache Artemis**, **Kafka Clients**, **Bouncy Castle**, **Plexus Utils**, and **Apache MINA**, covering risks including authentication bypass, request smuggling, denial of service, directory traversal, arbitrary file write, and information disclosure.
Aug 20, 2026
Red Hat released **RHSA-2026:25089** for **HawtIO 4.4.0** in the **Red Hat build of Apache Camel 4**, shipping an Important-rated security update that fixes a broad set of vulnerabilities across bundled components. The advisory covers issues in **Spring Boot**, **axios**, **Jetty**, **Quarkus Vert.x HTTP**, **Vert.x Core**, **fast-uri**, lodash-related HawtIO code, and Go libraries used by the `hawtio-operator-container`, with impacts ranging from remote and arbitrary code execution to authentication and authorization bypass, path traversal, prototype pollution, denial of service, certificate validation bypass, information disclosure, and session hijacking. A key issue addressed is **CVE-2026-2332**, an Important-severity HTTP request smuggling flaw in **Eclipse Jetty** caused by improper handling of chunk extensions with an unclosed double quote before `CRLF`. Red Hat said a remote attacker could exploit Jetty servers deployed behind reverse proxies or load balancers to bypass security controls, poison caches, or reach unauthorized endpoints, and noted no practical mitigation beyond updating affected packages. Red Hat listed fixes across multiple products, including **HawtIO**, **Red Hat AMQ Broker**, **Red Hat build of Apache Camel**, **Red Hat Enterprise Linux 9**, and several **Red Hat Satellite** releases, and urged customers to apply the relevant errata.
Aug 20, 2026
Red Hat released container-image and platform updates across its Kubernetes portfolio to remediate vulnerabilities in Go dependencies, chiefly **CVE-2024-45337** in `golang.org/x/crypto/ssh` and **CVE-2024-45338** in `golang.org/x/net/html`. The SSH issue can enable authorization bypass when applications misuse `ssh.ServerConfig.PublicKeyCallback`; the HTML flaw involves non-linear parsing of case-insensitive content. Affected products include OpenShift Container Platform 4.15 and 4.18, Advanced Cluster Management 2.9.6, Multicluster Global Hub 1.2 and 1.3, Gatekeeper 3.14 and 3.15, OpenShift Data Foundation 4.15, VolSync 0.10 and 0.11, and Advanced Cluster Security (RHACS) 4.4 and 4.5. Several releases also address **CVE-2024-53259**, a `quic-go` denial-of-service flaw in which forged ICMP Packet Too Large messages can disrupt established QUIC connections, and RHACS 4.6.2 fixes `go-git` argument injection (**CVE-2025-21613**) and malicious Git-server reply denial of service (**CVE-2025-21614**). Red Hat recommends upgrading affected platforms and container images through their supported release channels, including deployments on x86_64, aarch64, ppc64le, and s390x where applicable; RHACS customers should move to 4.4.8, 4.5.6, or 4.6.2 according to their release stream.
Aug 27, 2026