Red Hat Red Hat build of Apache Camel - HawtIO 4

• CVE-2026-81320 Medium 5.5 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level 0.2%
• CVE-2026-81303 Medium 6.3 Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname 0.5%
• CVE-2026-78234 Critical 9.9 Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users 0.4%
• CVE-2026-77968 High 8.2 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount 0.4%
• CVE-2026-28369 High 8.7 Undertow: undertow: request smuggling via malformed http request headers 0.7%
• CVE-2026-28367 High 8.7 Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator 0.7%
• CVE-2026-28368 High 8.7 Undertow: undertow: request smuggling via inconsistent header parsing 0.7%
• CVE-2025-12543 Critical 9.6 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf 1.3%
• CVE-2024-3884 High 7.5 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded 1.5%
• CVE-2025-9784 High 7.5 Undertow: undertow madeyoureset http/2 ddos vulnerability 2.3%
• CVE-2024-11831 Medium 5.4 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript 1.1%
• CVE-2024-3653 Medium 5.3 Undertow: learningpushhandler can lead to remote memory dos attacks 1.9%
• CVE-2024-5971 High 7.5 Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket 2.9%
• CVE-2024-6162 High 7.5 Undertow: url-encoded request path information can be broken on ajp-listener 1.7%
• CVE-2023-5685 High 7.5 Xnio: stackoverflowexception when the chain of notifier states becomes problematically big 3.5%