CVE-2026-43865

camel-hazelcast Reproductor de Deserialización Insegura de Instancia Predeterminada CVE-2026-43865 Este proyecto demuestra una vulnerabilidad de deserialización de Java en el componente camel-hazelcast de Apache Camel, rastreada como CVE-2026-43865. Cuando Camel construye la Config de Hazelcast p...

CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket producer selects its WebSocket recipients from websocket. Exchange headers whose names fall outside the Camel namespac...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound...

CVE-2026-48203

CVE-2026-48203 — camel-solr SolrParam. / SolrField. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel...

CVE-2026-46457

CVE-2026-46457 — camel-nats Inbound Header Injection SSRF Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-blob...

CVE-2026-46456

CVE-2026-46456 — camel-aws2-sqs Inbound Message-Attribute Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Hijacked sink| Demonstrated impact ---|---|---|---|--- Camel Spring Boot| camel-spring-boot/| Sprin...

CVE-2026-46454

camel-cometd Inbound Bayeux Header Injection Reproducer CVE-2026-46454 This project demonstrates a message-header injection in Apache Camel's camel-cometd component, tracked as CVE-2026-46454. The component maps inbound Bayeux CometD message headers into the Camel Exchange without...

CVE-2026-40453

Reproducción de Inyección de Encabezados Camel con Variantes de Mayúsculas CVE-2026-40453 Este proyecto demuestra CVE-2026-40453 — una corrección incompleta para CVE-2025-27636. La corrección de 2025 agregó setLowerCasetrue a HttpHeaderFilterStrategy para que los nombres de encabezado con variant...

CVE-2025-27636-Practical-Lab

🛡️ CVE-2025-27636 — Laboratorio Práctico de Explotación para Apache Camel 🔍 Resumen CVE-2025-27636 es una vulnerabilidad crítica de Ejecución Remota de Código RCE en Apache Camel , específicamente en el componente camel-exec. Surge de un problema sutil pero peligroso: DefaultHeaderFilterStrategy...

CVE-2026-42527

Permissive Default ObjectInputFilter — DNS Side-Channel Reproducer CVE-2026-42527 This project demonstrates CVE-2026-42527 in Apache Camel. The default ObjectInputFilter pattern that several Camel components ship for defense-in-depth deserialization filtering — java.;javax.;org.apache.camel.;! —...

CVE-2026-59230

CVE-2026-59230 — camel-mail MimeMultipart header injection headersInline Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-spring-boot 4.18.2 Camel...

CVE-2026-56139

camel-undertow Rest DSL muteException Stack-Trace Disclosure Reproducer CVE-2026-56139 This project demonstrates an information-disclosure issue in Apache Camel's camel-undertow Rest DSL consumer, tracked as CVE-2026-56139. The muteException option controls whether an uncaught processing...

CVE-2026-46584

CVE-2026-46584 — Inyección de Cabeceras mail.smtp. en camel-mail Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime: Runtime| Directorio| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18....

CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-datalak...

CVE-2026-66907

CVE-2026-66907 — camel-google-storage downloadFileName path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-google-storage 4.18.2 Camel...

CVE-2026-63621

CVE-2026-63621 — camel-knative structured CloudEvent header injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Style ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-knative 4.18.2|...

CVE-2026-33454

Inyección de Cabeceras en camel-mail → Reproducción de Vulnerabilidad RCE CVE-2026-33454 Este proyecto demuestra una vulnerabilidad de inyección de cabeceras de mensaje Camel en el componente camel-mail de Apache Camel, rastreada como CVE-2026-33454. Un atacante que pueda enviar un correo...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2026-49097

camel-irc irc.sendTo Header Injection Reproducer CVE-2026-49097 This project demonstrates a message-header injection in Apache Camel's camel-irc component, tracked as CVE-2026-49097. IrcProducer reads the irc.sendTo header to choose the destination of the outgoing IRC message; when present it...