Vendredi 12 juin 2026

netty · Red Hat Cryostat 4 on RHEL 9 · Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

netty · Red Hat Cryostat 4 on RHEL 9 · Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Apache Software Foundation Apache CXF · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform Expansion Pack

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Apache Software Foundation Apache CXF · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform Expansion Pack

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Apache Software Foundation Apache CXF · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat build of Apache Camel 4 for Quarkus 3

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.