CVE-2026-46456

CVE-2026-46456 — camel-aws2-sqs Inbound Message-Attribute Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Hijacked sink| Demonstrated impact ---|---|---|---|--- Camel Spring Boot| camel-spring-boot/| Sprin...

camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

CVE-2026-46456

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

ai.wanaku:wanaku-tool-service-sqs (>=0.0.4, <=0.0.7), org.apache.camel.kafkaconnector:camel-aws-s3-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-aws2-sqs MAVEN version =4.0.0-m1, =0.0.4, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.13.0...

org.apache.camel.quarkus:camel-quarkus-aws2-sqs (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-aws2-sqs-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-aws2-sqs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46456 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892595...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46456 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892595...

ai.wanaku:wanaku-tool-service-sqs (>=0.0.4, <=0.0.7), org.apache.camel.kafkaconnector:camel-aws-s3-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-56140 via org.apache.camel:camel-aws2-sqs (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-aws2-sqs MAVEN version =4.0.0-m1, =0.0.4, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.13.0...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-56140 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-56140 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821197...

org.apache.camel.quarkus:camel-quarkus-aws2-sqs (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-aws2-sqs-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-56140 via org.apache.camel:camel-aws2-sqs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-aws2-sqs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-56140 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821197...

org.apache.camel.quarkus:camel-quarkus-aws2-sqs (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-aws2-sqs-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-aws2-sqs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46456 Source advisory: GHSA-CMC3-HR79-8MMV...

ai.wanaku:wanaku-tool-service-sqs (>=0.0.4, <=0.0.7), org.apache.camel.kafkaconnector:camel-aws-s3-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-aws2-sqs MAVEN version =4.0.0, =0.0.4, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.13.0 and more Source c...

Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which blocks Camel, breadcrumbId and org.apache.camel. headers being written to t...

ai.wanaku:wanaku-tool-service-sqs (>=0.0.4, <=0.0.7), org.apache.camel.kafkaconnector:camel-aws-s3-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-aws2-sqs MAVEN version =4.0.0, =0.0.4, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.13.0 and more Source c...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46456 Source advisory: GHSA-CMC3-HR79-8MMV...

org.apache.camel.quarkus:camel-quarkus-aws2-sqs (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-aws2-sqs-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-aws2-sqs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46456 Source advisory: OSV:GHSA-CMC3-HR79-8MMV...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46456 Source advisory: OSV:GHSA-CMC3-HR79-8MMV...

GHSA-CMC3-HR79-8MMV Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which blocks Camel, breadcrumbId and org.apache.camel. headers being written to t...

ai.wanaku:wanaku-tool-service-sqs (>=0.0.4, <=0.0.7), org.apache.camel.kafkaconnector:camel-aws-s3-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-aws2-sqs MAVEN version =4.0.0, =0.0.4, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.13.0 and more Source c...

CVE-2026-46456

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

org.apache.camel.quarkus:camel-quarkus-aws2-sqs (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-aws2-sqs-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-aws2-sqs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46456 Source advisory: MEND:CVE-2026-46456...