Veille CVE

Recherche « Red Hat build of OptaPlanner 8 »

5 CVE

Critique 2 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat build of OptaPlanner 8 » ✕
  1. CVE-2026-40984 7.5 Élevée

    Spring Micrometer · Red Hat AMQ Broker 7.13.6 · Red Hat AMQ Broker 7.14.1 · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

    In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

  2. CVE-2026-42579 9.1 Critique

    netty · Red Hat Cryostat 4 on RHEL 9 · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · Red Hat build of Quarkus 3.27.4

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

  3. CVE-2026-39852 8.2 Élevée

    quarkusio quarkus · Red Hat Cryostat 4 on RHEL 9 · Red Hat HawtIO HawtIO 4.4.0 · Red Hat Build of Apache Camel 4.14 for Quarkus 3.27

    Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.

  4. CVE-2026-40976 9.1 Critique

    Spring Boot · Red Hat AMQ Broker 7 · Red Hat AMQ Clients · Red Hat build of Apache Camel for Spring Boot 4

    In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

  5. CVE-2026-40975 7.5 Élevée

    Spring Boot · Red Hat HawtIO HawtIO 4.4.0 · Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 · Red Hat Data Grid 8.6.1

    Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.