You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/07/05 09:20:51 UTC
(camel-website) 06/31: Added CVE-2026-46454
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 5dd713dd9c467d87c09ca98729faaf6550d015c5
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Jun 15 12:27:05 2026 +0200
Added CVE-2026-46454
Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
content/security/CVE-2026-46454.md | 17 +++++++++++++++++
content/security/CVE-2026-46454.txt.asc | 31 +++++++++++++++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/content/security/CVE-2026-46454.md b/content/security/CVE-2026-46454.md
new file mode 100644
index 00000000..885beb9c
--- /dev/null
+++ b/content/security/CVE-2026-46454.md
@@ -0,0 +1,17 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-46454"
+date: 2026-06-09T10:00:00+02:00
+url: /security/CVE-2026-46454.html
+draft: false
+type: security-advisory
+cve: CVE-2026-46454
+severity: MEDIUM
+summary: "Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers"
+description: "The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified. Because a CometdComponent [...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so client-supplied Camel* / camel* h [...]
+credit: "This issue was discovered by Yu Bao from PayPal"
+affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.14.8, 4.18.3 and 4.21.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23507 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23211 (commit e20bdc2a6a3fd1128bcebe1b64c8e8589f0bc57d) and backported to camel-4.18.x (commit e9c741b4908dcffc0e1a7b1a5e6207a46aaac608) and camel-4.14.x (commit 6fad391f9f5257b93ce07d9b8e5e7f486210d4f5). The issue is classified as CWE-20 (Improper Input Validation). It belongs t [...]
diff --git a/content/security/CVE-2026-46454.txt.asc b/content/security/CVE-2026-46454.txt.asc
new file mode 100644
index 00000000..42de74ba
--- /dev/null
+++ b/content/security/CVE-2026-46454.txt.asc
@@ -0,0 +1,31 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-46454"
+date: 2026-06-09T10:00:00+02:00
+url: /security/CVE-2026-46454.html
+draft: false
+type: security-advisory
+cve: CVE-2026-46454
+severity: MEDIUM
+summary: "Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers"
+description: "The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified. Because a CometdComponent [...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so client-supplied Camel* / camel* h [...]
+credit: "This issue was discovered by Yu Bao from PayPal"
+affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.14.8, 4.18.3 and 4.21.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23507 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23211 (commit e20bdc2a6a3fd1128bcebe1b64c8e8589f0bc57d) and backported to camel-4.18.x (commit e9c741b4908dcffc0e1a7b1a5e6207a46aaac608) and camel-4.14.x (commit 6fad391f9f5257b93ce07d9b8e5e7f486210d4f5). The issue is classified as CWE-20 (Improper Input Validation). It belongs t [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovy8EACgkQ406fOAL/
+QQCnzwgAt/h8xwSJISKfmphsT4XxME4V/Oj3EGg6VJXV+Om+8MdIgFqyqEo648Oq
+klXgDf1MHjSkS/xmQXwZLY0rIkbiiXH/Xklo9Vr1un9I5R+ntuHJ32FwizoQuYWp
+9UjZH60CGLmrHM8uvdHzINm6alCLitLoLo7vRg0W/yrWI6OVdFNeZP5iCDtSyLvw
+Q4/GtYwVsi5xakzhgLE1kkWu9h1Mi2cKqg6PR2cuqj93EENPL7VFkD7f5BVO3qp4
+5biPUMOxoKfPaCtTrdGsm7p+2pYygDSQetu0gywOEBmOdIfe/VjwoqGpK/VhpFXZ
+/NqWn4BL7iUoreZWfC8et9Rod96ykQ==
+=h2kJ
+-----END PGP SIGNATURE-----