15 matches found
CVE-2026-46457
CVE-2026-46457 — camel-nats Inbound Header Injection SSRF Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...
camel-nats: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
A flaw was found in Apache Camel NATS component. Due to improper input validation, a client capable of publishing to a NATS subject can inject arbitrary Camel control headers into the Camel Exchange. These injected headers can then influence the behavior of downstream producers in the route,...
Exploit for Improper Input Validation in Apache Camel
camel-nats Inbound Header Injection Reproducer CVE-2026-46457...
org.apache.camel.quarkus:camel-quarkus-integration-test-nats (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-nats (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46457 via org.apache.camel:camel-nats (>=4.19.0, <=4.20.0)
org.apache.camel:camel-nats MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46457 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879236...
org.apache.camel.kafkaconnector:camel-nats-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-nats-source-kafka-connector (>=4.0.0, <=4.14.5) +5 more potentially affected by CVE-2026-46457 via org.apache.camel:camel-nats (>=4.0.0, <=4.14.7)
org.apache.camel:camel-nats MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46457 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879236...
Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...
org.apache.camel.kafkaconnector:camel-nats-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-nats-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-46457 via org.apache.camel:camel-nats (>=4.15.0, <=4.18.2)
org.apache.camel:camel-nats MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46457 Source advisory: GHSA-7V55-Q9X3-83CJ...
org.apache.camel.kafkaconnector:camel-nats-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-nats-source-kafka-connector (>=4.0.0, <=4.14.5) +5 more potentially affected by CVE-2026-46457 via org.apache.camel:camel-nats (>=4.0.0, <=4.14.7)
org.apache.camel:camel-nats MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46457 Source advisory: OSV:GHSA-7V55-Q9X3-83CJ...
org.apache.camel.quarkus:camel-quarkus-integration-test-nats (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-nats (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46457 via org.apache.camel:camel-nats (>=4.19.0, <=4.20.0)
org.apache.camel:camel-nats MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46457 Source advisory: OSV:GHSA-7V55-Q9X3-83CJ...
GHSA-7V55-Q9X3-83CJ Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...
CVE-2026-46457 Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...
org.apache.camel.kafkaconnector:camel-nats-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-nats-source-kafka-connector (>=4.0.0, <=4.14.5) +5 more potentially affected by CVE-2026-46457 via org.apache.camel:camel-nats (>=4.0.0, <=4.14.7)
org.apache.camel:camel-nats MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46457 Source advisory: MEND:CVE-2026-46457...
EUVD-2026-41831
Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...
CVE-2026-46457: Improper Input Validation
Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...
PT-2026-55892
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the camel-nats component allows a client to inject arbitrary Camel...