CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket producer selects its WebSocket recipients from websocket. Exchange headers whose names fall outside the Camel namespac...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2026-71300

A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of t...

WebSocket Header Injection

Apache Camel Atmosphere Websocket component is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered websocket.connectionKey and websocket.connectionKey.list headers controlling WebSocket message dispatch, allowing an external sender to suppress or redirect messages to a...

External Control of Assumed-Immutable Web Parameter

Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

CVE-2026-71300

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

EUVD-2026-64961

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

CVE-2026-71300

The Apache Camel Atmosphere Websocket component contains an improper input validation vulnerability (CWE-20, CWE-74) affecting versions 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0. The root cause is that certain dispatch headers—such as websocket.connectionKey.list, websoc...

CVE-2026-71300

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

CVE-2026-71300 Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...