CVE-2026-48204

CVE-2026-48204 — camel-mongodb-gridfs gridfs. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

GridFsProducer Component Apache Camel Heap Buffer Overflow DoS

The vulnerability of the GridFsProducer class in the camel-mongodb-gridfs component, as well as the camel-atmosphere-websocket framework from the Apache Camel project, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to read...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48204 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875079...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-gridfs (>=3.2.0, <=3.13.0) +4 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48204 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875079...

org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-mongodb-gridfs (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48204 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875079...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-gridfs (>=3.2.0, <=3.13.0) +4 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48204 Source advisory: OSV:GHSA-F7G3-2CG6-F5HJ...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48204 Source advisory: OSV:GHSA-F7G3-2CG6-F5HJ...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-gridfs (>=3.2.0, <=3.13.0) +4 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48204 Source advisory: GHSA-F7G3-2CG6-F5HJ...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48204 Source advisory: GHSA-F7G3-2CG6-F5HJ...

org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-mongodb-gridfs (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48204 Source advisory: GHSA-F7G3-2CG6-F5HJ...

org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-mongodb-gridfs (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48204 Source advisory: OSV:GHSA-F7G3-2CG6-F5HJ...

CVE-2026-48204

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

CVE-2026-48204

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-mongodb-gridfs (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48204 Source advisory: MEND:CVE-2026-48204...

EUVD-2026-41839

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-gridfs (>=3.2.0, <=3.13.0) +4 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.0.0, <=4.14.7)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48204 Source advisory: MEND:CVE-2026-48204...

org.apache.camel.karaf:camel-mongodb-gridfs (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-mongodb-grouped (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-48204 via org.apache.camel:camel-mongodb-gridfs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-mongodb-gridfs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48204 Source advisory: MEND:CVE-2026-48204...

CVE-2026-48204

Apache Camel's camel-mongodb-gridfs component is vulnerable to Improper Input Validation and Improper Access Control in versions 4.0.0 to 4.20.9. The GridFsProducer class uses plain strings for control headers (e.g., gridfs.operation, gridfs.objectid) which do not start with the required Camel/ p...

CVE-2026-48204: Improper Input Validation

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

CVE-2026-9100

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash via a division-by-zero or silently leak process memo...