com.vaadin:vaadin-quarkus (1.0.0), com.vaadin:vaadin-quarkus-deployment (1.0.0) +672 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.3.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.vaadin:vaadin-quarkus 1.0.0 - com.vaadin:vaadin-quarkus-deployment 1.0.0 -...

io.quarkiverse.githubapp:quarkus-github-app (1.2.1), io.quarkiverse.githubapp:quarkus-github-app-deployment (1.2.1) +638 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app 1.2.1 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (0.10.0), io.automatiko.addons:automatiko-events-websocket-addon (0.10.0) +131 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon 0.10.0 -...

io.quarkus:quarkus-amazon-lambda-http (2.5.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (2.5.0.cr1) +102 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.5.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

com.qwlabs.doraemon:graphql (>=0.1.2, <=0.1.8), io.debezium:debezium-server (>=1.8.0.cr1, <=1.8.1.final) +614 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.qwlabs.doraemon:graphql =0.1.2, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1,...

com.github.t1:wunderbar.demo.product (2.1.4), com.radcortez.flyway:flyway-junit5-quarkus (1.3.0) +303 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.t1:wunderbar.demo.product 2.1.4 - com.radcortez.flyway:flyway-junit5-quarkus 1.3.0 -...

io.quarkiverse.githubapp:quarkus-github-app (>=1.5.0, <=1.6.0), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.5.0, <=1.6.0) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.6.0 -...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1138 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1138 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: GHSA-QCXP-GM7M-4J5V...

ai.pipestream.module:module-chunker (0.1.3), ai.pipestream.module:module-echo (0.1.3) +805 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0.cr1, =0.0.22, =0.7.28, =0.7.28, =0.7.25, =0.7.25, =0.7.28, =0.7.28, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.29 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

ai.pipestream.module:module-embedder (0.3.0), ai.pipestream.module:quarkus-djl-serving-embeddings (0.3.0) +176 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (3.37.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.pipestream.module:module-embedder 0.3.0 - ai.pipestream.module:quarkus-djl-serving-embeddings...

com.github.database-rider:rider-quarkus-sample (>=1.33.0, <=1.37.1), io.quarkiverse.artemis:quarkus-integration-test-artemis-core (1.0.6) +637 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.database-rider:rider-quarkus-sample =1.33.0, =1.37.1 -...

com.datastax.oss.quarkus:cassandra-quarkus-client (>=1.0.2, <=1.0.4), com.datastax.oss.quarkus:cassandra-quarkus-client-deployment (>=1.0.2, <=1.0.4) +119 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.13.7.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.datastax.oss.quarkus:cassandra-quarkus-client =1.0.2, =1.0.2, =1.0.2, =1.0.2, =1.0.2,...

CVE-2026-15075

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deser...

CVE-2026-40859

A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ObjectInputFilter VertxHttpHelper.deserializeJavaObjectFromStream and NettyHttpHelper.deserializeJavaObjectFromStream. An attacker can achieve remote code execution on a Camel application host b...

GHSA-6QW3-4796-5984 Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...