Chapter 1. Release notes for Red Hat build of Apache Camel for Quarkus 3.27 / 3.27.3.SP2


Fast startup and low RSS memory
Using the optimized build-time and ahead-of-time (AOT) compilation features of Quarkus, your Camel application can be pre-configured at build time resulting in fast startup times.
Application generator
Use the code.camel.redhat.com to bootstrap your application and discover its extension ecosystem.
Highly configurable

All the important aspects of a Red Hat build of Apache Camel for Quarkus application can be set up programmatically with CDI (Contexts and Dependency Injection) or by using configuration properties. By default, a CamelContext is configured and automatically started for you.

Check out the Configuring your Quarkus applications by using a properties file guide for more information on the different ways to bootstrap and configure an application.

Integrates with existing Quarkus extensions
Red Hat build of Apache Camel for Quarkus provides extensions for libraries and frameworks that are used by some Camel components which inherit native support and configuration options.

For information about supported platforms, configurations, and databases in Red Hat build of Apache Camel for Quarkus version 3.27, see the Supported Configuration page on the Customer Portal (login required).

For a list of Red Hat Red Hat build of Apache Camel for Quarkus extensions and the Red Hat support level for each extension, see the Extensions Overview chapter of the Red Hat build of Apache Camel for Quarkus Reference (login required).

To configure your Red Hat Red Hat build of Apache Camel for Quarkus version 3.27 projects to use the supported extensions, use the latest Bill Of Materials (BOM) version 3.27.3.SP2-redhat-00001 or newer, from the Redhat Maven Repository.

For more information about BOM dependency management, see Developing Applications with Red Hat build of Apache Camel for Quarkus

1.4. Technology preview extensions

Items designated as Technology Preview in the Extensions Overview chapter of the Red Hat build of Apache Camel for Quarkus Reference have limited supportability, as defined by the Technology Preview Features Support Scope.

1.5. Product errata and security advisories

1.5.1. Red Hat build of Apache Camel for Quarkus

For the latest Red Hat build of Apache Camel for Quarkus product errata and security advisories, see the Red Hat Product Errata page.

1.5.2. Red Hat build of Quarkus

For the latest Red Hat build of Quarkus product errata and security advisories, see the Red Hat Product Errata page.

1.6. Known issues

This affects quarkus-jdbc-postgresql.

When running a maven build with Red Hat build of Apache Camel for Quarkus version 3.27.3.SP2-redhat-00001, the build fails with with a java.lang.ref.Cleaner error, similar to this:

Error: Detected a java.lang.ref.Cleaner object in the image heap which uses a daemon thread that invokes cleaning actions, but threads running in the image generator are no longer running at image runtime.
    ...

The error is caused by a mismatch between version numbers in Quarkus core and the Postgres JDBC driver dependency.

Workaround

To avoid the error, add --initialize-at-run-time=org.postgresql.util.LazyCleanerImpl as additional build argument either in the command line, or in the application properties.

From the command line:

-Dquarkus.native.additional-build-args=--initialize-at-run-time=org.postgresql.util.LazyCleanerImpl

In application.properties:

quarkus.native.additional-build-args=--initialize-at-run-time=org.postgresql.util.LazyCleanerImpl

1.6.2. Limitations in Groovy extension

In this release, some important limitations apply to the Groovy extension.

1.6.2.1. Native mode limitations

Due to an issue in GraalVM / Mandrel 23.1.x, you must build your native application with the --report-unsupported-elements-at-runtime option. You can do this by adding the following configuration to application.properties.

quarkus.native.report-errors-at-runtime=true

1.6.2.2. Static compilation

Compilation of Groovy expressions is made with static compilation enabled. Which means that the types used in your expressions must be known at compile time. Refer to the Groovy documentation for more details.

This primarily impacts the customization of the Groovy Shell and the handling of exchange information. In native mode, customizing the Groovy Shell and accessing the following exchange variables will not function as expected.

  • attachment
  • exchangeProperty
  • exchangeProperties
  • header
  • log
  • variable
  • variables

If you use property placeholders within your expressions like.

from("direct:start")
    .transform().groovy("println '{{greeting.message}}'");

greeting.message will be evaluated once at build time and its value will be permanently stored in the native image. It is not possible to override the value of the property at runtime. Attempting to do so will result in an exception being thrown.

The endChoice method is changed to end().endChoice() (see CEQ-11181).

When using Choice EIP then in some situations you may need to use .endChoice() to be able to either continue added more nodes to the current Choice EIP, or that you are working with nested Choice EIPs (choice inside choice), then you may also need to use endChoice to go back to the parent choice to continue from there.

However, there has been some regressions from upgrading older Camel releases to 4.11, and therefore we have refactored endChoice to work more consistent.

For example, the following code:

from("direct:start")
    .choice()
        .when(header("foo").isGreaterThan(1))
            .choice()
                .when(header("foo").isGreaterThan(5))
                    .to("mock:big")
                .otherwise()
                    .to("mock:med")
            .endChoice()
        .otherwise()
            .to("mock:low")
        .end();

Should now be:

from("direct:start")
    .choice()
        .when(header("foo").isGreaterThan(1))
            .choice()
                .when(header("foo").isGreaterThan(5))
                    .to("mock:big")
                .otherwise()
                    .to("mock:med")
            .end().endChoice()
        .otherwise()
            .to("mock:low")
        .end();

The change of endChoice method to end().endChoice() makes the calls consistent.

This ends the current (inner) choice and changes the scope to Choice EIP to be able to continue in the previous (outer) choice.

This informs Java DSL that the scope is Choice EIP and you can add the otherwise block to the outer choice, which would otherwise not work.

We support both camel-quarkus-grpc and camel-vertx-websocket with Knative.

gRPC needs HTTP2 (you can find instructions on how to enable it here: HTTP2 on Knative).

Unfortunately, Websockets with Knative does not work with HTTP2 (see Ingress Operator in OpenShift Container Platform).

Consequently, if you have an application that is intended to accept WebSocket connections, it must not allow negotiating the HTTP/2 protocol or else clients will fail to upgrade to the WebSocket protocol.

1.6.5. Error when running maven update

When running a maven update with a specified version:

mvn com.redhat.quarkus.platform:quarkus-maven-plugin:{camel-quarkus-maven-plugin-version}:update -Drewrite

This can cause an error similar to this:

Failed to apply the updates: The project is missing the Quarkus platform BOM in module foo.

The affected modules are specific to your project, so you need to read the error message to find the affected modules.

Workaround

To avoid the error, add the quarkus-resteasy dependency to the modules mentioned in the error message.

In our example, the foo module, add the dependency to foo/pom.xml:

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-resteasy</artifactId>
</dependency>

When running a camel CLI project export, the export may fail with errors related to missing artifacts or classes.

As a workaround, before installing Camel CLI, you can add Red Hat repositories to your local Maven configuration file.

1.7. Important notes

1.7.1. Support for IBM Power and IBM Z

Red Hat build of Apache Camel for Quarkus is supported on IBM Power and IBM Z.

1.7.2. Minimum Java version - JDK 17

Red Hat build of Apache Camel for Quarkus version 3.27 requires JDK 17 or newer.

1.7.3. Support for OpenJDK

Red Hat build of Apache Camel for Quarkus version 3.27 includes support for OpenJDK 21.

1.7.4. Support for AdoptiumJDK

Red Hat build of Apache Camel for Quarkus version 3.27 includes support for AdoptiumJDK 17 and AdoptiumJDK 21.

For important information about upgrading Camel, see the Apache Camel manual sections:

Red Hat build of Apache Camel for Quarkus version 3.27 has been upgraded from Camel version 4.10.4 to Camel version 4.14.2. For additional information about each intervening Camel patch release, refer to the following:

Red Hat build of Apache Camel for Quarkus version 3.27 has been upgraded from Camel Quarkus version 3.20 to Camel Quarkus version 3.27. For additional information about each intervening Camel Quarkus patch release, refer to the following:

1.9. Resolved issues

The following lists shows known issues that were affecting Red Hat build of Apache Camel for Quarkus, which have been fixed in Red Hat build of Apache Camel for Quarkus version 3.27.

Expand
Table 1.1. Red Hat build of Apache Camel for Quarkus resolved issues in version 3.27.3.SP1
 IssueDescription

1

CEQ-13043

CVE-2026-0636 bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java

2

CEQ-13038

CVE-2026-3505 bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

3

CEQ-13037

CVE-2026-5588 bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid

4

CEQ-13036

Solved through upgrade of Bouncy Castle to version 1.84:

CVE-2025-14813 bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly

5

CEQ-13000

CVE-2026-35554 kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management

6

CEQ-12924

CVE-2026-39852 quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

Expand
Table 1.2. Red Hat build of Apache Camel for Quarkus resolved issues in version 3.27.3
 IssueDescription

1

CEQ-12815

CVE-2026-33871 netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood

2

CEQ-12803

CVE-2026-33870 netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

3

CEQ-12601

CVE-2026-1002 vertx-core: static handler component cache can be manipulated to deny the access to static files

Expand
Table 1.3. Red Hat build of Apache Camel for Quarkus resolved issues in version 3.27.2
 IssueDescription

1

CEQ-12480

Backport CAMEL-22784 - Failover in FileLockClusterService is unreliable when running multiple JVMs

2

CEQ-12033

Add support for configuring proxy host, proxy port, and no-proxy settings

Expand
Table 1.4. Red Hat build of Apache Camel for Quarkus resolved issues in version 3.27.1.SP1
 IssueDescription

7

CEQ-12239

CVE-2025-66566 lz4-java: Information Disclosure via Insufficient Output Buffer Clearing

Expand
Table 1.5. Red Hat build of Apache Camel for Quarkus resolved issues in version 3.27.1
 IssueDescription

1

CEQ-11915

Using JPA component in Split block lead to various errors

Expand
Table 1.6. Red Hat build of Apache Camel for Quarkus Resolved CVEs in version 3.27.0
 IssueDescription

1

CEQ-11887

CVE-2025-59952 io.minio/minio: minio-java Client XML Tag is Vulnerable to Value Substitution

2

CEQ-11874

CVE-2025-59952 minio: minio-java Client XML Tag is Vulnerable to Value Substitution

Expand
Table 1.7. Red Hat build of Apache Camel for Quarkus resolved issues in version 3.27.0
 IssueDescription

1

CEQ-11714

ComponentsBuilderFactory should provide builders for unsupported components when explicitly required

2

CEQ-11704

Productize camel-debug

3

CEQ-11684

Support extension: camel-quarkus-crypto-pgp

4

CEQ-11395

Support extension camel-quarkus-azure-storage-datalake

5

CEQ-11304

[CAMEL-22059] Backport Request: camel-ssh - Calling 2nd time does not keep correct exit value header.

6

CEQ-11203

camel-rest: Contract first implementation doesn’t honor the contextPath set in restConfiguration.

7

CEQ-11185

Lack of Contents About "REST DSL With Contract-First OpenAPI".

8

CEQ-11544

[Doc] Missing backport CEQ-11181 in the release notes for 3.20

The following capabilities are deprecated in this release.

1.10.1. Jolokia /q/jolokia endpoint

The camel-quarkus-jolokia register-management-endpoint default has been changed to false.

When using camel-quarkus-jolokia, the /q/jolokia Quarkus management endpoint is no longer registered by default. It has been deprecated for removal in a future release.

If you need to restore the previous behavior and expose /q/jolokia, you can add the following to application.properties.

quarkus.camel.jolokia.register-management-endpoint=true

However, as mentioned above, this option will eventually be removed.

1.10.2. Olingo4

The Apache Olingo project has been retired.

The Olingo4 component camel-olingo4 is deprecated in this release.

There is currently no viable replacement component, although `camel-sap´ might work for limited cases.

The following table lists the extensions added in the Red Hat build of Apache Camel for Quarkus version 3.27 release .

Expand
Table 1.8. Added extensions
 ExtensionArtifactDescription

1

Crypto PGP

camel-quarkus-crypto-pgp

Encrypt and decrypt messages using Bouncy Castle OpenPGP API.

2

Opensearch

camel-quarkus-opensearch

Send requests to OpenSearch via Java Client API.

3

Mail Microsoft Oauth

camel-quarkus-mail-microsoft-oauth

Camel Mail OAuth2 Authenticator for Microsoft Exchange Online

4

Azure Storage Datalake

camel-quarkus-azure-storage-datalake

Camel Azure Datalake Gen2 Component.

The following table lists the extensions added in the Red Hat build of Apache Camel for Quarkus version 3.27 release .

Expand
Table 1.9. Removed extensions
ExtensionArtifactDescriptionNote

Quarkus CXF Transports HTTP Async

quarkus-cxf-rt-transports-http-hc5

Implement async SOAP Clients using Apache HttpComponents HttpClient 5.

The extension has been deprecated since Quarkus CXF 3.19.0 and was removed in 3.22.0.

Use the asynchronous mode of VertxHttpClientHTTPConduit instead. All asynchronous client functionality is now supported by the io.quarkiverse.cxf:quarkus-cxf extension. You do not need any additional extension for that.

No extensions have changed support levels in the Red Hat build of Apache Camel for Quarkus version 3.27 release.

The following table lists the data formats that have been added in the Red Hat build of Apache Camel for Quarkus version 3.27 release.

Expand
Table 1.10. Added data formats
ExtensionArtifactDescription

JAXP

camel-quarkus-jaxp

XML JAXP type converters and parsers

This document may help when upgrading from the 3.20 LTS stream to 3.27 LTS stream.

1.13.1.1. Important dependency upgrades

1.13.1.2. New and noteworthy in Quarkus CXF

Before Quarkus CXF 3.22.0, when a SOAP client application using asynchronous clients was under high load, it might have taken every long time till there was a worker thread available for executing the client call.

In such situations, it was hard to figure out, what was the root cause of those hanging clients.

In Quarkus CXF 3.22.0, we introduced the quarkus.cxf.client.worker-dispatch-timeout configuration parameter, that limits the time SOAP clients can wait for a free executor thread. In case the timeout is surpassed, an exception is thrown informing about the problem:

Unable to dispatch SOAP client call within 30000 ms on a worker thread due to worker thread pool exhaustion.
You may want to adjust one or more of the following configuration options:
quarkus.thread-pool.core-threads, quarkus.thread-pool.max-threads, quarkus.cxf.client.worker-dispatch-timeout

XJC Plugins are one of the ways how the Java files produced by wsdl2java can be customized.

Before Quarkus CXF 3.23.0, only XJC Plugins from org.apache.cxf.xjcplugins:cxf-xjc-* were supported via io.quarkiverse.cxf:quarkus-cxf-xjc-plugins.

Since Quarkus CXF 3.23.0, also CXF Plugins org.jvnet.jaxb:jaxb-plugins can be used via io.quarkiverse.cxf:quarkus-cxf-jaxb-plugins extension.

Check the wsdl2java guide for more details.

See the ducumentation of the new options:

1.13.1.3. Fixed issues

Before Quarkus CXF 3.26.1, if the WSDL of a client contained elements from the http://schemas.xmlsoap.org/wsdl/http/ namespace, like in the following example

<?xml version='1.0' encoding='UTF-8'?>
<wsdl:definitions
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
    xmlns:tns="http://test.deployment.cxf.quarkiverse.io/"
    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
    xmlns:ns1="http://schemas.xmlsoap.org/soap/http"
    name="ExtensorsService"
    targetNamespace="http://test.deployment.cxf.quarkiverse.io/"
    xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" >
...
  <wsdl:portType name="ExtensorsServiceGet" />
  <wsdl:binding name="ExtensorsServiceGet" type="tns:ExtensorsServiceGet">
    <http:binding verb="GET" />
  </wsdl:binding>
  <wsdl:service name="ExtensorsService">
    <wsdl:port binding="tns:ExtensorsServiceGet" name="ExtensorsServiceGet" >
      <http:address location="http://localhost:8081/soap/ExtensorsServiceGet" />
    </wsdl:port>
  </wsdl:service>
</wsdl:definitions>

then the application would fail during boot in native mode with an error message similar to the following:

ERROR [io.qua.run.Application] (main) Failed to start application: java.lang.RuntimeException: Failed to start quarkus
        at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
        ...
Caused by: org.apache.cxf.service.factory.ServiceConstructionException: SERVICE_CREATION_MSG
        at org.apache.cxf.wsdl11.WSDLServiceFactory.<init>(WSDLServiceFactory.java:87)
        ...
Caused by: javax.wsdl.WSDLException: WSDLException (at /wsdl:definitions/wsdl:binding[2]/http:binding): faultCode=CONFIGURATION_ERROR: Problem instantiating Java extensionType 'com.ibm.wsdl.extensions.http.HTTPBindingImpl'.: java.lang.InstantiationException: com.ibm.wsdl.extensions.http.HTTPBindingImpl
        at javax.wsdl.extensions.ExtensionRegistry.createExtension(ExtensionRegistry.java:383)
        ...
Caused by: java.lang.InstantiationException: com.ibm.wsdl.extensions.http.HTTPBindingImpl
        at java.base@21.0.8/java.lang.Class.newInstance(DynamicHub.java:719)
        ...
Caused by: java.lang.NoSuchMethodException: com.ibm.wsdl.extensions.http.HTTPBindingImpl.<init>()
        at java.base@21.0.8/java.lang.Class.checkMethod(DynamicHub.java:1078)
        at java.base@21.0.8/java.lang.Class.getConstructor0(DynamicHub.java:1241)
        at java.base@21.0.8/java.lang.Class.newInstance(DynamicHub.java:706)
        ... 28 more

Since Quarkus CXF 3.26.1, no classes related to the http://schemas.xmlsoap.org/wsdl/http/ namespace need to be registered for reflection by end users.

Special thanks to Lazaro Miguel Coronado Torres for reporting this issue.

1.13.1.4. Deprecations and removals

The HttpClientHTTPConduitFactory value of quarkus.cxf.http-conduit-factory and quarkus.cxf.client."client-name".http-conduit-factory was deprecated since Quarkus CXF 3.18.0 , because it never gained any real traction within Quarkus CXF.

HttpClientHTTPConduitFactory was removed from Quarkus CXF 3.22.0.

Use the default VertxHttpClientHTTPConduit instead.

Both the removal of HttpClientHTTPConduitFactory and quarkus-cxf-rt-transports-http-hc5 (see the next section) are a part of our efforts to support only a single HTTP Conduit based on Vert.x HttpClient in the future. For now, the URLConnectionHTTPConduitFactory stays fully supported, although it is not used by default since Quarkus CXF 3.16.0.

Check quarkus.cxf.http-conduit-factory and quarkus.cxf.client."client-name".http-conduit-factory for more information.

io.quarkiverse.cxf:quarkus-cxf-rt-transports-http-hc5 has been deprecated since Quarkus CXF 3.19.0 and was removed in 3.22.0.

Use the asynchronous mode of VertxHttpClientHTTPConduit instead. All asynchronous client functionality is now supported by the io.quarkiverse.cxf:quarkus-cxf extension. You do not need any additional extension for that.

1.13.1.5. Documentation improvements

1.13.1.6. Full changelog

https://github.com/quarkiverse/quarkus-cxf/compare/3.27.1...3.20.2

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

Legal Notice

Theme

© 2026 Red Hat
Back to top