CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket producer selects its WebSocket recipients from websocket. Exchange headers whose names fall outside the Camel namespac...

Vaadin input validation error vulnerability

Security vulnerabilities exist in Vaadin versions ranging from 14.14.0 to 14.14.7, 23.6.0 to 23.6.16, 24.4.0 to 24.4.25, 24.5.0 to 24.5.15, 24.6.0 to 24.6.13, 24.7.0 to 24.7.16, 24.8.0 to 24.8.17, 24.9.0 to 24.9.23, 24.10.0 to 24.10.11, 25.0.0 to 25.0.13, 25.1.0 to 25.1.13, 25.2.0 to 25.2.10, and...

Push endpoint returns permissive CORS headers

The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability ha...

Push endpoint returns permissive CORS headers

The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability ha...

com.github.cloudbow:rmq-publisher (>=0.0.1, <=0.0.6), io.latent:storm-rabbitmq (1.0.0) +3 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.5.0)

com.rabbitmq:amqp-client MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.cloudbow:rmq-publisher =0.0.1, =2.3.0, =2.3.0, =2.4.5 - ru.kiryam:storm-rabbitmq 0.6.2 Source cves:...

com.github.cloudbow:rmq-publisher (>=0.0.1, <=0.0.6), io.latent:storm-rabbitmq (1.0.0) +3 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (3.5.0)

com.rabbitmq:amqp-client MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.cloudbow:rmq-publisher =0.0.1, =2.3.0, =2.3.0, =2.4.5 - ru.kiryam:storm-rabbitmq 0.6.2 Source cves:...

com.github.cloudbow:rmq-publisher (>=0.0.1, <=0.0.6), io.latent:storm-rabbitmq (1.0.0) +3 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (3.5.0)

com.rabbitmq:amqp-client MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.cloudbow:rmq-publisher =0.0.1, =2.3.0, =2.3.0, =2.4.5 - ru.kiryam:storm-rabbitmq 0.6.2 Source cves:...

CVE-2026-71300

A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of t...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-release, <=1.1.3-release) +20 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (3.6.0)

com.rabbitmq:amqp-client MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.1-release, =1.1.1-release, =1.1.1-release, =1.1.1-release,...

com.github.cloudbow:rmq-publisher (>=0.0.1, <=0.0.6), io.latent:storm-rabbitmq (1.0.0) +3 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (3.5.0)

com.rabbitmq:amqp-client MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.cloudbow:rmq-publisher =0.0.1, =2.3.0, =2.3.0, =2.4.5 - ru.kiryam:storm-rabbitmq 0.6.2 Source cves:...

WebSocket Header Injection

Apache Camel Atmosphere Websocket component is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered websocket.connectionKey and websocket.connectionKey.list headers controlling WebSocket message dispatch, allowing an external sender to suppress or redirect messages to a...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

External Control of Assumed-Immutable Web Parameter

Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

GHSA-M5R8-W65Q-8WJF Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...