You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/07/05 09:20:59 UTC
(camel-website) 14/31: Added CVE-2026-46592
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 562cb9f21c68db429c078dc8f32cd352073be948
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Jun 15 12:27:06 2026 +0200
Added CVE-2026-46592
Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
content/security/CVE-2026-46592.md | 17 +++++++++++++++++
content/security/CVE-2026-46592.txt.asc | 31 +++++++++++++++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/content/security/CVE-2026-46592.md b/content/security/CVE-2026-46592.md
new file mode 100644
index 00000000..696a8996
--- /dev/null
+++ b/content/security/CVE-2026-46592.md
@@ -0,0 +1,17 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-46592"
+date: 2026-06-11T10:00:00+02:00
+url: /security/CVE-2026-46592.html
+draft: false
+type: security-advisory
+cve: CVE-2026-46592
+severity: MEDIUM
+summary: "Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation"
+description: "The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP r [...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pa [...]
+credit: "This issue was discovered by Yu Bao from PayPal"
+affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.14.8, 4.18.3 and 4.21.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23526 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23326 (commit 7240570a05687792c95badfa8d11ed2644117230) and backported to camel-4.18.x (commit 36a5088b58be38317a8f974ffda2a262fa00b4e4) and camel-4.14.x (commit 0138da45fc9428172c1585ab4561d42e8868cf49). The fix renames the camel-cxf Exchange header values to the Camel conventio [...]
diff --git a/content/security/CVE-2026-46592.txt.asc b/content/security/CVE-2026-46592.txt.asc
new file mode 100644
index 00000000..f601aed8
--- /dev/null
+++ b/content/security/CVE-2026-46592.txt.asc
@@ -0,0 +1,31 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-46592"
+date: 2026-06-11T10:00:00+02:00
+url: /security/CVE-2026-46592.html
+draft: false
+type: security-advisory
+cve: CVE-2026-46592
+severity: MEDIUM
+summary: "Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation"
+description: "The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP r [...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pa [...]
+credit: "This issue was discovered by Yu Bao from PayPal"
+affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.14.8, 4.18.3 and 4.21.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23526 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23326 (commit 7240570a05687792c95badfa8d11ed2644117230) and backported to camel-4.18.x (commit 36a5088b58be38317a8f974ffda2a262fa00b4e4) and camel-4.14.x (commit 0138da45fc9428172c1585ab4561d42e8868cf49). The fix renames the camel-cxf Exchange header values to the Camel conventio [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovx0kACgkQ406fOAL/
+QQD+rggArX4gV3sZdb1eyOc2dkYmA7GJV4JVa9MdjrFuZy+Tqt9T8eK8D2L5yxld
+kJoajcdMeM/GFsS/BSr3QhoPTGlWd55ViBbW+9tbCFGvqwI1bHZYeQ/vK0sbq1ty
+R20d7xr8cRMy5kKpCrPQEFkH5DsVcysuvmxV44gNzhNrqBEyGXPjHu8VEruu29ss
+sPR5k8yGzmWO4icQ+wheOD/+LxCn8PBOrO/PD5CIYbitFpyg+t7Cz0dvzNXWojn1
+CRRD2L5ypit1ut6JEuneDzqJtuPEtPkXdFmSIZ4J/d5D/lpi8TsT+Jmc/SspiOqG
+TuW6xgWg4Q3oUmOfH+2Og70fACYS9A==
+=ZYJf
+-----END PGP SIGNATURE-----