You are viewing a plain text version of this content. The canonical link for it is here.
- Re: [VOTE] Release Apache Camel 4.14.8 (LTS) - posted by Marat Gubaidullin <ma...@gmail.com> on 2026/07/01 01:20:01 UTC, 2 replies.
- Re: [VOTE] Release Apache Camel 4.18.3 (LTS) - posted by Marat Gubaidullin <ma...@gmail.com> on 2026/07/01 01:22:42 UTC, 1 replies.
- [REPORT] Monthly Camel static code analysis - 2026/06 - posted by Pasquale Congiusti <pa...@gmail.com> on 2026/07/01 07:37:53 UTC, 0 replies.
- Camel 4.21 whats new blog - posted by Claus Ibsen <cl...@gmail.com> on 2026/07/01 11:45:46 UTC, 0 replies.
- Re: [VOTE] Release Apache Camel 4.21.0 (LTS) - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/01 17:35:24 UTC, 0 replies.
- [RESULT] [VOTE] Release Apache Camel 4.21.0 - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/01 17:40:42 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.21.0 Released - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/02 04:24:49 UTC, 0 replies.
- Kamelets for 4.21 release - posted by Claus Ibsen <cl...@gmail.com> on 2026/07/02 10:48:14 UTC, 3 replies.
- [HEADS UP] - Main is now 4.22.0-SNAPSHOT - posted by Claus Ibsen <cl...@gmail.com> on 2026/07/02 17:28:13 UTC, 0 replies.
- [RESULT] [VOTE] Release Apache Camel 4.18.3 (LTS) - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/03 09:47:12 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.18.3 (LTS) Released - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/03 11:06:46 UTC, 0 replies.
- [VOTE] Release Apache Camel Kamelets 4.21.0 - posted by Andrea Cosentino <an...@gmail.com> on 2026/07/03 12:16:38 UTC, 4 replies.
- Re: Camel 4.22 LTS in August - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/04 08:18:18 UTC, 1 replies.
- [RESULT] [VOTE] Release Apache Camel 4.14.8 (LTS) - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/04 09:01:22 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.14.8 (LTS) Released - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/07/05 07:07:05 UTC, 0 replies.
- CVE-2026-56140: Apache Camel: Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components; because camel-aws2-sns is producer-only (no consumer) there is no reachable inbound header-injection path, so this is a defense-in- - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:45:55 UTC, 0 replies.
- CVE-2026-56139: Apache Camel: Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients - and the option was not honoured - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:46:42 UTC, 0 replies.
- CVE-2026-55994: Apache Camel: Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling server-side request forgery and disclosure of secrets when bridged - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:47:33 UTC, 0 replies.
- CVE-2026-55993: Apache Camel: Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling server-side request forgery and disclosure of secr - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:48:17 UTC, 0 replies.
- CVE-2026-53913: Apache Camel: Camel-Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration (no required roles or permissions) the token is never verified and any non-null bearer value is accepted - a - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:49:04 UTC, 0 replies.
- CVE-2026-49365: Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:49:45 UTC, 0 replies.
- CVE-2026-49099: Apache Camel: Camel-Salesforce: Non-Camel-prefixed Exchange header constants (sObjectQuery, sObjectSearch, apexUrl, ...) bypass the HTTP header filter, allowing an HTTP client to inject SOQL/SOSL queries, override the target SObject, and redirect Apex REST calls using t - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:50:23 UTC, 0 replies.
- CVE-2026-49098: Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:51:02 UTC, 0 replies.
- CVE-2026-49097: Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:51:42 UTC, 0 replies.
- CVE-2026-49086: Apache Camel: Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to redirect the re-published message to an arbitrary Dapr Pub/Su - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:52:21 UTC, 0 replies.
- CVE-2026-48206: Apache Camel: Camel-JIRA: A set of non-Camel-prefixed Exchange header constants (IssueKey, ProjectKey, IssueTransitionId, ...) bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentials - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:52:57 UTC, 0 replies.
- CVE-2026-48205: Apache Camel: Camel-DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect DNS queries to an attacker-controlled server (server-side request forgery) and enumerate internal - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:53:41 UTC, 0 replies.
- CVE-2026-48204: Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:54:21 UTC, 0 replies.
- CVE-2026-48203: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:55:06 UTC, 0 replies.
- CVE-2026-46726: Apache Camel: Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling server-side request forgery and disclosure of - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:55:57 UTC, 0 replies.
- CVE-2026-46592: Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:56:37 UTC, 0 replies.
- CVE-2026-46591: Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169) - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:57:11 UTC, 0 replies.
- CVE-2026-46590: Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048) - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:57:59 UTC, 0 replies.
- CVE-2026-46585: Apache Camel: Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:59:26 UTC, 0 replies.
- CVE-2026-46584: Apache Camel: Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties, allowing an attacker to weaken the SMTP transport security and, on releases before 4.19.0, redirect the connection and steal - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:00:01 UTC, 0 replies.
- CVE-2026-46457: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:00:47 UTC, 0 replies.
- CVE-2026-46456: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:01:29 UTC, 0 replies.
- CVE-2026-46455: Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:02:08 UTC, 0 replies.
- CVE-2026-46454: Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:02:40 UTC, 0 replies.
- CVE-2026-46453: Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:03:15 UTC, 0 replies.
- CVE-2026-43865: Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:04:33 UTC, 0 replies.
- CVE-2026-42527: Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:05:27 UTC, 0 replies.
- CVE-2026-43866: Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/06 07:24:09 UTC, 0 replies.
- CVE-2026-43867: Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/06 08:15:00 UTC, 0 replies.
- CVE-2026-46587: Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input - posted by Federico Mariani <fm...@apache.org> on 2026/07/06 09:23:54 UTC, 0 replies.
- CVE-2026-46588: Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input - posted by Federico Mariani <fm...@apache.org> on 2026/07/06 09:24:02 UTC, 0 replies.
- CVE-2026-49042: Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters - posted by Federico Mariani <fm...@apache.org> on 2026/07/06 09:24:08 UTC, 0 replies.
- [VOTE] Release Apache Camel Quarkus 3.27.5 - posted by Jiří Ondrušek <on...@gmail.com> on 2026/07/07 14:38:18 UTC, 3 replies.
- [VOTE] Release Apache Camel Quarkus 3.33.2 - posted by Jiří Ondrušek <on...@gmail.com> on 2026/07/08 14:18:52 UTC, 3 replies.
- [RESULT][VOTE] Release Apache Camel Quarkus 3.27.5 - posted by Jiří Ondrušek <on...@gmail.com> on 2026/07/13 06:35:12 UTC, 0 replies.
- [RESULT][VOTE] Release Apache Camel Quarkus 3.33.2 - posted by Jiří Ondrušek <on...@gmail.com> on 2026/07/13 09:28:15 UTC, 0 replies.
- [VOTE] Release Apache Camel Kamelets 4.18.3 - posted by Andrea Cosentino <an...@gmail.com> on 2026/07/13 09:37:07 UTC, 4 replies.
- [VOTE] Release Apache Camel Upgrade Recipes 4.21.0 - posted by Jiří Ondrušek <on...@gmail.com> on 2026/07/14 11:39:29 UTC, 7 replies.
- CAMEL-23382: Unified AI tool abstraction (camel-ai-tool) - Heads-up - posted by Zineb Bendhiba <be...@gmail.com> on 2026/07/16 07:44:57 UTC, 0 replies.
- [RESULT] [VOTE] Release Apache Camel Upgrade Recipes 4.21.0 - posted by Jiří Ondrušek <on...@gmail.com> on 2026/07/17 13:33:52 UTC, 0 replies.
- [VOTE] Release Apache Camel Quarkus 3.38.0 - posted by James Netherton <ja...@gmail.com> on 2026/07/23 14:38:04 UTC, 5 replies.
- [RESULT][VOTE] Release Apache Camel Quarkus 3.38.0 - posted by James Netherton <ja...@gmail.com> on 2026/07/27 06:08:29 UTC, 0 replies.
- Introduction - integration engineer interested in contributing, healthcare components - posted by vishal khobare <vi...@gmail.com> on 2026/07/28 12:08:13 UTC, 0 replies.
- [REPORT] Monthly Camel static code analysis - 2026/07 - posted by Pasquale Congiusti <pa...@gmail.com> on 2026/07/31 09:56:46 UTC, 0 replies.
- GitHub CI Usage - July 2026 - posted by Aurelien Pupier via dev <de...@camel.apache.org> on 2026/07/31 12:53:16 UTC, 0 replies.