CVE-2026-93572: Red Hat Build Of Apache Camel For Spring Boot 4

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.

Affected products

• Red Hat Red Hat Build Of Apache Camel For Spring Boot 4
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-18. Last modified 2026-09-25.