CVE-2026-85312

CVE-2026-85312 — camel-core: saga hijacking via the Long-Running-Action header Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-core's SagaProcessor selected the saga coordinator from the Long-Running-Action message header on every exchange. That header name...

Exploit for CVE-2026-85312

CVE-2026-85312 — camel-core: saga hijacking via the Long-Runn...

ai.wanaku.sdk:capabilities-runtimes-camel-common (>=0.1.1, <=0.1.2), ai.wanaku.sdk:capabilities-runtimes-camel-plugin (>=0.1.1, <=0.1.2) +286 more potentially affected by CVE-2026-85312 via org.apache.camel:camel-core (>=4.0.0, <=4.18.4)

org.apache.camel:camel-core MAVEN version =4.0.0, =0.1.1, =0.1.1, =1.1.0, =1.1.0, =3.2.0, =3.2.0, =3.2.0, =1.3.0, =1.4.1 and more Source cves: CVE-2026-85312 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429450...

Reliance on Untrusted Inputs in a Security Decision

Overview org.apache.camel:camel-core is a powerful open source integration framework based on known Enterprise Integration Patterns with powerful bean integration. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the...

ai.wanaku.sdk:capabilities-runtimes-camel-common (>=0.1.1, <=0.1.2), ai.wanaku.sdk:capabilities-runtimes-camel-plugin (>=0.1.1, <=0.1.2) +2126 more potentially affected by CVE-2026-85312 via org.apache.camel:camel-core-processor (>=4.15.0, <=4.18.4)

org.apache.camel:camel-core-processor MAVEN version =4.15.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =2.85.0, =2.64.0, =1.4.8, =2.0.0, =1.4.8, =1.4.8, =1.4.8, =1.4.8, =1.4.8, =1.4.8, =2.0.2 and more Source cves: CVE-2026-85312 Sourc...

CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85312

Apache Camel's Camel-Core component is vulnerable to Improper Input Validation (CWE-20) in versions 4.0.0 to 4.18.4, 4.19.0 to 4.22.0, and other versions prior to 4.23.0. The saga processor incorrectly processes the Long-Running-Action header because it lacks a Camel prefix, allowing it to bypass...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Camel-core (CVE-2020-11971)

Summary Rebind Flaw vulnerability in Camel-core may affect IBM Spectrum Control. CVE-2020-11971. Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrad...

br.com.senior:crm-http-camel-api (>=0.0.2-alpha, <=0.0.81-alpha), br.com.senior:novasoft-http-camel-api (>=0.0.3-alpha, <=0.0.93-alpha) +2844 more potentially affected by CVE-2025-27636 via org.apache.camel:camel-support (>=3.10.0, <=3.22.3)

org.apache.camel:camel-support MAVEN version =3.10.0, =0.0.2-alpha, =0.0.3-alpha, =0.0.1-alpha, =1.0.0-alpha-1, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =18.4.0, =18.4.0, =24.17.0 and more Source cves: CVE-2025-27636 Source advisory:...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.33.0 security update & enhancements

Release of OpenShift Serverless Logic 1.33.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +622 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=3.0.0, <=3.21.3)

org.apache.camel:camel-core MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m1, =3.0.0, =3.0.0, =1.0.3, =3.11.0, =1.5, =1.21 and more Source cves: CVE-2024-22371 Source advisory: GHSA-QPXM-689R-3849...

com.artnaseef:correlation-id-utils-camel-v4 (2.4.0), de.ikor.sip.foundation:sip-integration-starter (>=3.3.0, <=3.5.0) +22 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.1.0, <=4.3.0)

org.apache.camel:camel-core MAVEN version =4.1.0, =3.3.0, =3.3.0, =3.3.0, =6.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.3.0 and more Source cves: CVE-2024-22371 Source advisory: OSV:GHSA-QPXM-689R-3849...

com.artnaseef:correlation-id-utils-camel-v4 (2.4.0), de.ikor.sip.foundation:sip-integration-starter (>=3.3.0, <=3.5.0) +22 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.1.0, <=4.3.0)

org.apache.camel:camel-core MAVEN version =4.1.0, =3.3.0, =3.3.0, =3.3.0, =6.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.3.0 and more Source cves: CVE-2024-22371 Source advisory: GHSA-QPXM-689R-3849...

org.apache.camel.karaf:camel-commands-core (3.22.0), org.apache.camel.karaf:camel-karaf-commands (3.22.0) +14 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (3.22.0)

org.apache.camel:camel-core MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-commands-core 3.22.0 - org.apache.camel.karaf:camel-karaf-commands 3.22.0 -...

org.apache.camel.karaf:camel-commands-core (3.22.0), org.apache.camel.karaf:camel-karaf-commands (3.22.0) +14 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (3.22.0)

org.apache.camel:camel-core MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-commands-core 3.22.0 - org.apache.camel.karaf:camel-karaf-commands 3.22.0 -...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +622 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=3.0.0, <=3.21.3)

org.apache.camel:camel-core MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m1, =3.0.0, =3.0.0, =1.0.3, =3.11.0, =1.5, =1.21 and more Source cves: CVE-2024-22371 Source advisory: OSV:GHSA-QPXM-689R-3849...

com.artnaseef:correlation-id-utils-camel-v4 (2.4.0), de.ikor.sip.foundation:sip-integration-starter (>=3.3.0, <=3.5.0) +22 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.1.0, <=4.3.0)

org.apache.camel:camel-core MAVEN version =4.1.0, =3.3.0, =3.3.0, =3.3.0, =6.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.3.0 and more Source cves: CVE-2024-22371 Source advisory: MEND:CVE-2024-22371...

org.apache.camel.karaf:camel-commands-core (3.22.0), org.apache.camel.karaf:camel-karaf-commands (3.22.0) +14 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (3.22.0)

org.apache.camel:camel-core MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-commands-core 3.22.0 - org.apache.camel.karaf:camel-karaf-commands 3.22.0 -...