Search
Search Results (26 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119542 | 2 Infinispan, Redhat | 10 Infinispan, Build Of Apache Camel For Quarkus, Camel Quarkus and 7 more | 2026-11-03 | 4.3 Medium |
| A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability. | ||||
| CVE-2026-86404 | 1 Redhat | 6 Amq Broker, Build Of Apache Camel For Quarkus, Build Of Apache Camel For Spring Boot and 3 more | 2026-11-01 | 8.8 High |
| EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default. | ||||
| CVE-2026-87743 | 2 Red Hat, Redhat | 19 Red Hat Openshift Ai (rhoai), Apicurio Registry, Build Keycloak and 16 more | 2026-10-29 | 7.5 High |
| A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information. | ||||
| CVE-2026-12894 | 1 Redhat | 7 Apache Camel Quarkus, Build Of Apache Camel For Quarkus, Build Of Quarkus and 4 more | 2026-10-20 | 8.8 High |
| A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands. | ||||
| CVE-2026-6857 | 1 Redhat | 10 Apache Camel Quarkus, Apache Camel Spring Boot, Build Of Apache Camel For Quarkus and 7 more | 2026-10-09 | 7.5 High |
| A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability. | ||||
| CVE-2026-84218 | 1 Redhat | 8 Amq Broker, Build Of Apache Camel For Quarkus, Build Of Apache Camel For Spring Boot and 5 more | 2026-09-03 | 8.1 High |
| A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM. | ||||