Red Hat Build Of Apache Camel 3.33.3.sp2 vulnerabilities

9 CVEs affecting Red Hat Build Of Apache Camel 3.33.3.sp2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93569, published 2026-09-18.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-93567, published 2026-09-18. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for…
• CVE-2026-93569, published 2026-09-18. High severity, CVSS 8.2. EPSS: 2.2% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form…
• CVE-2026-93558, published 2026-09-18. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the…
• CVE-2026-93568, published 2026-09-18. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly…
• CVE-2026-93564, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead…
• CVE-2026-19611, published 2026-08-20. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more…
• CVE-2026-93488, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides…
• CVE-2026-93565, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote…
• CVE-2026-93491, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This…