CVE-2026-48203 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

🗓️ 06 Jul 2026 08:06:22Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Apache Camel Solr header prefixes bypass HTTP filter, enabling server-side forgery via HTTP bridge.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-48203	6 Jul 202608:06	–	attackerkb
Circl	CVE-2026-48203	5 Jul 202620:31	–	circl
CVE	CVE-2026-48203	6 Jul 202608:06	–	cve
Cvelist	CVE-2026-48203 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields	6 Jul 202608:06	–	cvelist
EUVD	EUVD-2026-41838	6 Jul 202608:06	–	euvd
NVD	CVE-2026-48203	6 Jul 202609:16	–	nvd
Positive Technologies	PT-2026-55899	6 Jul 202600:00	–	ptsecurity
Snyk	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	6 Jul 202610:35	–	snyk
Vulnrichment	CVE-2026-48203 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields	6 Jul 202608:06	–	vulnrichment

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/05/17
repo	www.repo.maven.apache.org/maven2
camel	www.camel.apache.org/security/CVE-2026-48203.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48203.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48203

15 Jul 2026 01:49Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.1

EPSS0.0037

apache camel solr component header prefixes http header filter server side forgery upgrade recommended