CVE-2026-46454

camel-cometd 入站 Bayeux 头注入复现器 CVE-2026-46454 该项目演示了 Apache Camel 的 camel-cometd 组件中的一个消息头注入 漏洞，漏洞编号为 CVE-2026-46454 。该组件在没有HeaderFilterStrategy 的情况下，将入站的 Bayeux CometD 消息头映射到 Camel Exchange 中。CometdBinding.createCamelMessage 会将 CometD 客户端提供的整个 ext.CamelHeaders map 直接复制到 Camel 消息上...

Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

GHSA-R9CC-J7WR-P329 Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

CVE-2026-46454

The Apache Camel Cometd Component suffers from an improper input validation vulnerability (CWE-20) where it fails to apply a HeaderFilterStrategy when mapping inbound Bayeux (CometD) message headers into the Camel Exchange. Specifically, the CometdBinding.populateExchangeFromMessage (or createCam...

CVE-2026-46454

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

PT-2026-55889

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Apache Camel Cometd component allows unauthenticated users to injec...

EUVD-2013-6298

Malware in sbrugna...

Faye Trust Management Issue Vulnerability

Faye is a set of open source based on the Bayeux protocol publish-subscribe messaging system . The system is mainly used for publish-subscribe messaging between Web clients . A trust management issue vulnerability exists in versions of Faye prior to 1.4.0, which stems from the program failing to...

CVE-2013-6495

JBossWeb Bayeux has reflected XSS...

Cross site scripting

JBossWeb Bayeux has reflected XSS...

CVE-2013-6495

JBossWeb Bayeux has reflected XSS...

CVE-2013-6495

CVE-2013-6495 concerns JBossWeb Bayeux with a reflected XSS vulnerability. Public details in the provided documents identify the flaw as a reflected XSS issue. NVD indicates CVSS2 base score 4.3 (MEDIUM) and CVSS3.1 base score 6.1 (MEDIUM). Connected entries list the CVE among Red Hat advisories ...

bayeux-encheres.auction.fr XSS vulnerability

Vulnerable URL:...

Bayeux: Reflected Cross-Site Scripting (XSS)

JBossWeb Bayeux has reflected XSS...

Bayeux: Reflected Cross-Site Scripting (XSS)

JBossWeb Bayeux has reflected XSS...

Bayeux: Reflected Cross-Site Scripting (XSS)

JBossWeb Bayeux has reflected XSS...

Bayeux: Reflected Cross-Site Scripting (XSS)

JBossWeb Bayeux has reflected XSS...