RHSA-2026:37390

Details:

Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot patch release and security update is now available.

The purpose of this text-only errata is to inform you about the security issues fixed.

Security Fix(es):

• cxf-services-xkms-x509-repo-ldap: Apache CXF: Information Disclosure via LDAP Injection (CVE-2026-44930)

• cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration (CVE-2026-50632)

• cxf-rt-rs-security-oauth2-saml: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims (CVE-2026-50627)

• cxf-rt-rs-security-oauth2: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims (CVE-2026-50627)

• cxf-rt-rs-security-oauth2-saml: cxf: Unauthorized access due to logic error in OAuthRequestFilter (CVE-2026-50628)

• cxf-rt-rs-security-oauth2: cxf: Unauthorized access due to logic error in OAuthRequestFilter (CVE-2026-50628)

• cxf-integration-jca: Apache CXF: Arbitrary code execution via JNDI Injection (CVE-2026-50633)

• cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening (CVE-2026-49875)

• netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)

• netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250)

• netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)

• netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340)

• netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)

• netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006)

• netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records...