CVE-2026-46726 Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header...

CVE-2026-46726

Apache Camel's camel-vertx-websocket component is vulnerable to Server-Side Request Forgery (SSRF) and Secret Disclosure due to improper input validation in VertxWebsocketConsumer.populateExchangeHeaders(). The consumer maps inbound WebSocket query and path parameters into the Camel Exchange head...

CVE-2026-46726 Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header...

org.apache.camel.karaf:camel-vertx-websocket (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.0.0, <=4.14.7)

org.apache.camel:camel-vertx-websocket MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46726 Source advisory: MEND:CVE-2026-46726...

org.apache.camel.karaf:camel-vertx-websocket (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-websocket MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46726 Source advisory: MEND:CVE-2026-46726...

org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-vertx-websocket (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-websocket MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46726 Source advisory: MEND:CVE-2026-46726...

OpenStack Nova can leak consoleauth token into log files

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is...

PYSEC-2026-857 OpenStack Nova can leak consoleauth token into log files

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is...

OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

PYSEC-2026-883 OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion,...

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion,...

Important: Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

An update for nodejs24 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

MiracleLinux 9 : qemu-kvm-10.1.0-17.el9.ML.1 (AXSA:2026-1134:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1134:02 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the MiracleLinux security...

ALSA-2026:35891 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-55993: Improper Input Validation

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header...

ALSA-2026:35892 Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

PT-2026-55898

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header...

CVE-2026-46726: Improper Input Validation

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header...

RHEL 10 : nodejs24 (RHSA-2026:35841)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35841 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...