Details:
An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP2).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:
- jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [rhboac-camel-quarkus-3] (CVE-2026-54513)
- jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [rhboac-camel-quarkus-3] (CVE-2026-54512)
- micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests [rhboac-camel-quarkus-3] (CVE-2026-40983)
- micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [rhboac-camel-quarkus-3] (CVE-2026-40984)
- cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening [rhboac-camel-quarkus-3] (CVE-2026-49875)