Red Hat Red Hat build of Apache Camel - HawtIO 4
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-81320 | | Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-81303 | | Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-78234 | | Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users | CRITICAL 9.9 | 0.4 % | ||
| CVE-2026-77968 | | Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount | HIGH 8.2 | 0.4 % | ||
| CVE-2026-28369 | | Undertow: undertow: request smuggling via malformed http request headers | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-28367 | | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-28368 | | Undertow: undertow: request smuggling via inconsistent header parsing | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-7885 | | Undertow: improper state management in proxy protocol parsing causes information leakage | HIGH 7.5 | 2.6 % | ||
| CVE-2024-3653 | | Undertow: learningpushhandler can lead to remote memory dos attacks | MEDIUM 5.3 | 1.9 % | ||
| CVE-2024-5971 | | Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket | HIGH 7.5 | 2.9 % | ||
| CVE-2024-6162 | | Undertow: url-encoded request path information can be broken on ajp-listener | HIGH 7.5 | 1.7 % | ||
| CVE-2024-2700 | | Quarkus-core: leak of local configuration properties into quarkus applications | HIGH 7.0 | 0.3 % | ||
| CVE-2023-5685 | | Xnio: stackoverflowexception when the chain of notifier states becomes problematically big | HIGH 7.5 | 3.5 % |