Chapter 1. Red Hat build of Apache Camel for Spring Boot 4.14 release notes


Red Hat build of Apache Camel for Spring Boot introduces Camel support for Spring Boot which provides auto-configuration of Camel, and starters for many Camel components. The opinionated auto-configuration of the Camel context auto-detects Camel routes available in the Spring context and registers key Camel utilities (like producer template, consumer template and the type converter) as beans.

1.3. The javax to jakarta Package Namespace Change

The Java EE move to the Eclipse Foundation and the establishment of Jakarta EE, since Jakarta EE 9, packages used for all EE APIs have changed to jakarta.*

Code snippets in documentation have been updated to use the jakarta.* namespace, but you of course need to take care and review your own applications.

Note

This change does not affect javax packages that are part of Java SE.

When migrating applications to EE 10, you need to:

  • Update any import statements or other source code uses of EE API classes from the javax package to jakarta.
  • Change any EE-specified system properties or other configuration properties whose names begin with javax. to begin with jakarta..
  • Use the META-INF/services/jakarta.[rest_of_name] name format to identify implementation classes in your applications that use the implement EE interfaces or abstract classes bootstrapped with the java.util.ServiceLoader mechanism.

1.3.1. Migration tools

1.4.1. camel-olingo4 component is deprecated

The camel-olingo4 component is now deprecated. This is due to the project Apache Olingo is no more maintained.

1.4.2. Upgrade to Spring Boot 3.5.x

Red Hat build of Apache Camel for Spring Boot is upgraded to Spring Boot 3.5.x. For more information about the changes from Spring Boot 3.4 to Spring Boot 3.5, refer Spring Boot 3.5 Release notes.

1.4.3. Support for IBM Power and IBM Z

Red Hat build of Camel Spring Boot is now supported on IBM Power and IBM Z.

1.4.4. Changes to the snowdrop groupId

The snowdrop groupId is changed from me.snowdrop to dev.snowdrop. You must update the pom.xml file accordingly.

To use the Automatic Camel context reloading on Secret Refresh feature, the secret update has to be done either via UI or via API call with opereation PutSecretValue. The camel context reload will not be triggered with executing updateSecret via Camel.

Following table lists the Bill of Material versions for Red Hat build of Apache Camel for Spring Boot.

Expand
Table 1.1. BOM versions for Red Hat build of Apache Camel for Spring Boot
Release versionBOM versionSpring Boot version

4.14.4

4.14.4.redhat-00010

3.5.11

4.14.2

4.14.2.redhat-00015

3.5.8

4.14.1

4.14.1.redhat-00011

3.5.7

The following sections list the issues that have been resolved in Red Hat build of Apache Camel for Spring Boot.

The following sections list the issues that have been resolved in Red Hat build of Apache Camel for Spring Boot 4.14.4.

Expand
Table 1.2. Red Hat build of Apache Camel for Spring Boot version 4.14.4 resolved issues
IssueDescription

CSB-8095

CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

CSB-8155

RemoteFileProduces ignores the result of Noop

CSB-8516

CVE-2026-1002 vertx-core: static handler component cache can be manipulated to deny the access to static files

CSB-8616

JBang export causes IllegalArgumentException with Cassandra sink/source kamelet

CSB-8621

CVE-2026-27727 mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

CSB-8631

CVE-2026-27830 com.mchange/c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

In addition to above issues, Red Hat build of Apache Camel for Spring Boot version 4.14.4 also included several upstream fixes. For more information about these fixes, refer Resolved issues.

The following sections list the issues that have been resolved in Red Hat build of Apache Camel for Spring Boot 4.14.2 Patch 1.

Expand
Table 1.3. Red Hat build of Apache Camel for Spring Boot version 4.14.2 Patch 1 resolved issues
IssueDescription

CSB-8336

CVE-2025-66566 lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing

CSB-8351

camel-http: useSystemProperties property defined at component level is ignored

CSB-8358

Camel throws NullPointerException when returning a Response with null entity form jax-rs

CSB-8411

[CAMEL-22832] camel-azure-storage-blob: upload big files using uploadBlockBlobFromFile

The following sections list the issues that have been resolved in Red Hat build of Apache Camel for Spring Boot 4.14.2.

Expand
Table 1.4. Red Hat build of Apache Camel for Spring Boot version 4.14.2 resolved issues
IssueDescription

CSB-7692

CVE-2025-9784 undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability.

CSB-8164

CVE-2025-48924 Uncontrolled Recursion vulnerability in Apache Commons Lang.

CSB-8247

CVE-2025-66516 tika-core: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected.

In addition to above issues, Red Hat build of Apache Camel for Spring Boot version 4.14 also included several upstream fixes. For more information about these fixes, refer Resolved issues.

The following sections list the issues that have been resolved in Red Hat build of Apache Camel for Spring Boot 4.14.

Expand
Table 1.5. Red Hat build of Apache Camel for Spring Boot version 4.14 resolved issues
IssueDescription

CSB-6437

CXF opentelemetry - using same trace id from different http requests on RHEL9

CSB-6914

Protobuf jar is not added to the classpath when exporting routes with Kamelets

CSB-7423

Upgrade to Spring Boot 3.5.x

CSB-7688

Support component camel-azure-storage-datalake-starter

CSB-7692

CVE-2025-9784 undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability

CSB-7695

Expose extra micrometer metrics

CSB-7722

Agroal datasource documentation

CSB-7769

[JBang] Cannot execute export/run command

CSB-7790

Jira component error using basic authentication

CSB-7793

Optional AutoConfigure Actuator dependency missing in web applications

CSB-7796

Support camel-kafka "breakOnFirstError=true" with "batching=true"

CSB-8054

Spring Batch doesn’t register custom job bean

In addition to above issues, Red Hat build of Apache Camel for Spring Boot version 4.14 also included several upstream fixes. For more information about these fixes, refer Resolved issues.

The following sections list known issues for Red Hat build of Apache Camel for Spring Boot.

When upgrading from version 4.10.3 to 4.10.7 of Red Hat build of Camel Spring Boot, the API changes in AgroalDataSourceAutoConfiguration require code updates, which specifically affect programmatic DataSource configurations. Projects that use programmatic DataSource definitions (rather than auto-configuration) will experience compilation errors and need code modifications. After upgrading from version 4.10.3 to 4.10.7, the AgroalDataSourceAutoConfiguration constructor requires additional parameters wrapped in ObjectProvider.

Following sample shows the required changes.

Before version 4.10.7

    @ConfigurationProperties("app.datasource.ds1.agroal")
    public AgroalDataSource firstDataSource(
        @Qualifier("ds1properties") DataSourceProperties properties,
        JtaTransactionManager jtaPlatform,
        XAResourceRecoveryRegistry xaResourceRecoveryRegistry,
        ObjectProvider<AgroalDataSourceJndiBinder> jndiBinder) {

        return new AgroalDataSourceAutoConfiguration(jtaPlatform, xaResourceRecoveryRegistry)
            .dataSource(properties, false, false, jndiBinder);
    }

After upgrading to version 4.10.7

    @ConfigurationProperties("app.datasource.ds1.agroal")
    public AgroalDataSource firstDataSource(
        @Qualifier("ds1properties") DataSourceProperties properties,
        ObjectProvider<JtaTransactionManager> jtaPlatform,
        ObjectProvider<XAResourceRecoveryRegistry> xaResourceRecoveryRegistry,
        ObjectProvider<AgroalDataSourceJndiBinder> jndiBinder,
        ObjectProvider<AgroalSecurityProvider> securityProvider) {

        return new AgroalDataSourceAutoConfiguration(jtaPlatform, xaResourceRecoveryRegistry, jndiBinder, securityProvider)
            .dataSource(properties, true, false, false, new ArrayList<Object>(), new ArrayList<Object>());
    }

CSB-6748 Method AttachmentMessage.getAttachments() return value changed
When you use the method AttachmentMessage.getAttachments() it returns an empty list instead of the null value when there are no attachments.

The following sections list known issues for Red Hat build of Apache Camel for Spring Boot.

CSB-6748 Method AttachmentMessage.getAttachments() return value changed
When you use the method AttachmentMessage.getAttachments() it returns an empty list instead of the null value when there are attachments.
CSB-6437 CXF opentelemetry - using same trace id from different http requests on RHEL9
This issue only occurs with CXF and OpenTelemetry with the custom tracing configuration on RHEL 9 platform. ,In case of CXF and opentelemetry with the custom opentelemetry tracer defined, when you call multiple requests, the trace ID seems to be reused in the Camel routes. The result is that new spans are added in the existing traces for each http request, instead of creating one new trace ID for each http request. The workaround is to explicitly define the ContextPropagators to W3CTraceContextPropagator as shown in the example below:
    @Bean
    ContextPropagators contextPropagators() {
       // return ContextPropagators.create(TextMapPropagator.composite(W3CBaggagePropagator.getInstance()));
       return ContextPropagators.create(W3CTraceContextPropagator.getInstance());
    }
CSB-4318 Fail to deploy on OCP using Openshift Maven Plugin if spring.boot.actuator.autoconfigure is not in the dependencies

Jkube maven plugin uses the following condition to check if the application exposes health endpoint (using SpringBootHealthCheckEnricher). Both classes are in the classpath:

  • org.springframework.boot.actuate.health.HealthIndicator
  • org.springframework.web.context.support.GenericWebApplicationContext

However, the /actuator/health wil be not exposed without the configuration of the actuator. This creates discordance between the readiness/liveness probes configured by JKube (they both uses the above endpoint) and what the application is exposing.

This misconfiguration causes a failing deployment config on OpenShift Container Platform since the generated pod will never be in Ready status since the probe`s call for an endpoint is not configured. So in order to make the application work on OpenShift Container Platform, which is deployed using JKube (openshift-maven-plugin), it is necessary to have both web and actuator autoconfiguration in the dependencies.

Following example shows how to configure web and actuator autoconfiguration.

Example

<dependency>
 <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

Update the archetype as shown below. The applications built from the following archetype will be deployed correctly using JKube.

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-web</artifactId>
    <exclusions>
      <exclusion>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-tomcat</artifactId>
      </exclusion>
    </exclusions>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

This issue affects the custom applications with missing one of the above dependencies.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

Legal Notice

Theme

© 2026 Red Hat
Back to top