You are viewing a plain text version of this content. The canonical link for it is here.
- CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening - posted by James Netherton <ja...@apache.org> on 2026/10/01 07:11:24 UTC, 0 replies.
- [ANNOUNCEMENT] Apache Camel Karavan 4.22.1 - posted by Marat Gubaidullin <ma...@gmail.com> on 2026/10/08 23:06:02 UTC, 0 replies.
- CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/09 11:40:37 UTC, 0 replies.
- CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/09 11:41:37 UTC, 0 replies.
- [D] Karavan 4.22.1 Bug: Component action buttons missing on Web UI [camel-karavan] - posted by "wnehdi (via GitHub)" <gi...@apache.org> on 2026/10/10 21:09:28 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.18.5 (LTS) Released - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/10/11 18:55:23 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.23.0 Released - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/10/15 15:14:06 UTC, 0 replies.
- CVE-2026-71569: Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:19:10 UTC, 0 replies.
- CVE-2026-78162: Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:19:38 UTC, 0 replies.
- CVE-2026-78163: Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:19:58 UTC, 0 replies.
- CVE-2026-78164: Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:20:28 UTC, 0 replies.
- CVE-2026-78165: Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:20:43 UTC, 0 replies.
- CVE-2026-79983: Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:21:02 UTC, 0 replies.
- CVE-2026-79984: Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:23:16 UTC, 0 replies.
- CVE-2026-79985: Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:23:30 UTC, 0 replies.
- CVE-2026-79986: Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:23:47 UTC, 0 replies.
- CVE-2026-80312: Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:24:14 UTC, 0 replies.
- CVE-2026-80343: Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:24:31 UTC, 0 replies.
- CVE-2026-80344: Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:24:49 UTC, 0 replies.
- CVE-2026-83531: Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:25:12 UTC, 0 replies.
- CVE-2026-84176: Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:25:33 UTC, 0 replies.
- CVE-2026-84178: Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:02 UTC, 0 replies.
- CVE-2026-84180: Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:15 UTC, 0 replies.
- CVE-2026-84181: Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:30 UTC, 0 replies.
- CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:56 UTC, 0 replies.
- CVE-2026-85245: Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:30:18 UTC, 0 replies.
- CVE-2026-85246: Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:32:04 UTC, 0 replies.
- CVE-2026-85247: Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:32:51 UTC, 0 replies.
- CVE-2026-85248: Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:33:03 UTC, 0 replies.
- CVE-2026-85249: Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:33:23 UTC, 0 replies.
- CVE-2026-85250: Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:33:43 UTC, 0 replies.
- CVE-2026-85251: Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:34:10 UTC, 0 replies.
- CVE-2026-85254: Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:34:30 UTC, 0 replies.
- CVE-2026-85257: Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:34:56 UTC, 0 replies.
- CVE-2026-85260: Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:35:26 UTC, 0 replies.
- CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:38:24 UTC, 0 replies.
- CVE-2026-85300: Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:38:40 UTC, 0 replies.
- CVE-2026-85301: Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:38:58 UTC, 0 replies.
- CVE-2026-85312: Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:39:12 UTC, 0 replies.
- CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:39:34 UTC, 0 replies.
- CVE-2026-85314: Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:39:49 UTC, 0 replies.
- CVE-2026-85315: Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:40:02 UTC, 0 replies.
- CVE-2026-85316: Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:40:27 UTC, 0 replies.
- CVE-2026-85317: Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:41:05 UTC, 0 replies.
- CVE-2026-88901: Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:41:21 UTC, 0 replies.
- CVE-2026-91858: Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:42:01 UTC, 0 replies.
- Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0 - posted by Andrea Cosentino <an...@gmail.com> on 2026/10/18 13:01:30 UTC, 0 replies.
- CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/19 10:53:24 UTC, 0 replies.
- [VOTE] Release Apache Camel Kamelets 4.23.0 - posted by Andrea Cosentino <an...@gmail.com> on 2026/10/20 07:57:48 UTC, 3 replies.
- Camel K version 3 development plan - posted by Pasquale Congiusti <pa...@gmail.com> on 2026/10/22 06:47:19 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.22.2 (LTS) Released - posted by Gregor Zurowski <gr...@list.zurowski.org> on 2026/10/22 14:54:28 UTC, 0 replies.