Filtered by vendor Redhat Subscriptions
Filtered by product Build Of Apache Camel Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-50633 2 Apache, Redhat 3 Cxf, Build Of Apache Camel, Fuse 2026-11-05 8.1 High
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVE-2026-50628 2 Apache, Redhat 4 Cxf, Build Of Apache Camel, Fuse and 1 more 2026-11-05 9.8 Critical
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVE-2026-50632 2 Apache, Redhat 6 Cxf, Build Of Apache Camel, Enterprise Linux and 3 more 2026-11-05 8.1 High
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVE-2026-50627 2 Apache, Redhat 4 Cxf, Build Of Apache Camel, Fuse and 1 more 2026-11-05 9.1 Critical
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVE-2025-12543 1 Redhat 19 Apache Camel Hawtio, Apache Camel Spring Boot, Build Of Apache Camel and 16 more 2026-11-05 9.6 Critical
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
CVE-2026-49875 2 Apache, Redhat 7 Cxf, Build Of Apache Camel, Enterprise Linux and 4 more 2026-10-29 6.5 Medium
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.