CVE-2026-48205

camel-dns dns. / term Header Injection Reproducer CVE-2026-48205 This project demonstrates a message-header injection in Apache Camel's camel-dns component, tracked as CVE-2026-48205. The DNS producers read their operation parameters — the resolver to query, the name/domain to look up, the record...

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

org.apache.camel.karaf:camel-dns (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-dns (>=3.0.0-m1, <=3.27.4) +3 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-dns MAVEN version =4.0.0-m1, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.14.7 Source cves: CVE-2026-48205 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892614...

org.apache.camel.karaf:camel-dns (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-dns (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dns MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48205 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892614...

org.apache.camel.quarkus:camel-quarkus-dns (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-dns-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dns MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48205 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892614...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the DnsConstants header handling in components/camel-dns/src/main/java/org/apache/camel/component/dns/DnsConstants.java and the DNS producers that consume those headers. An attacker can redirect DNS...

org.apache.camel.karaf:camel-dns (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-dns (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.0.0, <=4.14.7)

org.apache.camel:camel-dns MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48205 Source advisory: GHSA-HCM8-X79P-WX2W...

org.apache.camel.karaf:camel-dns (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-dns (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dns MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48205 Source advisory: GHSA-HCM8-X79P-WX2W...

org.apache.camel.karaf:camel-dns (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-dns (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.0.0, <=4.14.7)

org.apache.camel:camel-dns MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48205 Source advisory: OSV:GHSA-HCM8-X79P-WX2W...

org.apache.camel.karaf:camel-dns (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-dns (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dns MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48205 Source advisory: OSV:GHSA-HCM8-X79P-WX2W...

org.apache.camel.quarkus:camel-quarkus-dns (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-dns-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dns MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48205 Source advisory: OSV:GHSA-HCM8-X79P-WX2W...

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers who...

org.apache.camel.quarkus:camel-quarkus-dns (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-dns-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dns MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48205 Source advisory: GHSA-HCM8-X79P-WX2W...

CVE-2026-48205

Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers who...

org.apache.camel.karaf:camel-dns (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-dns (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.0.0, <=4.14.7)

org.apache.camel:camel-dns MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-48205 Source advisory: MEND:CVE-2026-48205...

org.apache.camel.karaf:camel-dns (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-dns (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dns MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48205 Source advisory: MEND:CVE-2026-48205...

org.apache.camel.quarkus:camel-quarkus-dns (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-dns-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-48205 via org.apache.camel:camel-dns (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dns MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48205 Source advisory: MEND:CVE-2026-48205...

CVE-2026-48205 Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers who...

CVE-2026-48205 Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers who...

org.apache.camel:camel-dns (>=2.7.0, <=2.7.5), org.apache.james:james-server-container-spring (3.0-m2) +4 more potentially affected by CVE-2024-25638 via dnsjava:dnsjava (2.1.0)

dnsjava:dnsjava MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on dnsjava:dnsjava and may be impacted: - org.apache.camel:camel-dns =2.7.0, =1.1, =1.3.4 Source cves: CVE-2024-25638 Source advisory: OSV:GHSA-CFXW-4H78-H7FW...