apache/camel Security Advisories

critical2026-08-24

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

GHSA-v7h8-xhh6-gfj4 · CVE-2026-78329

medium2026-08-24

Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

GHSA-vvwm-3j43-7pfm · CVE-2026-63621

critical2026-08-24

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

GHSA-m5r8-w65q-8wjf · CVE-2026-71300

high2026-08-24

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

GHSA-fpm2-m4qq-wghr · CVE-2026-66908

high2026-08-24

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

GHSA-f78g-9385-qxqj · CVE-2026-66907

medium2026-08-24

Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

GHSA-cx47-qxp5-mmh2 · CVE-2026-59230

medium2026-08-24

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

GHSA-7jwc-q3fj-c9pq · CVE-2026-60093

critical2026-08-24

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

GHSA-2x37-89hj-2j95 · CVE-2026-66906

high2026-07-06

Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters

GHSA-hh8r-75r6-qrg9 · CVE-2026-49042

high2026-07-06

Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

GHSA-5g68-f6xg-vf2r · CVE-2026-46588

high2026-07-06

Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

GHSA-46jf-c9vx-hh79 · CVE-2026-46587

medium2026-07-06

Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

GHSA-hjg2-f45w-c566 · CVE-2026-56139

critical2026-07-06

Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

GHSA-w2v8-8q6c-3rhr · CVE-2026-56140

high2026-07-06

Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy

GHSA-rcvm-6r79-cf4r · CVE-2026-55993

critical2026-07-06

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

GHSA-qvc3-6q9x-95pj · CVE-2026-53913

high2026-07-06

Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

GHSA-pw9q-pq7c-rfqw · CVE-2026-55994

medium2026-07-06

Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter

GHSA-mm84-qvjh-hcj7 · CVE-2026-49098

critical2026-07-06

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

GHSA-hcm8-x79p-wx2w · CVE-2026-48205

medium2026-07-06

Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

GHSA-gcc7-c8mp-34qx · CVE-2026-49099

medium2026-07-06

Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter

GHSA-64gv-6cq2-45jr · CVE-2026-48206