CVE-2026-71569

CVE-2026-71569 — camel-a2a: the webhook guard accepted an IPv6 unique local address reached through a host name Runnable proof-of-concept reproducer for the Apache Camel vulnerability where WebhookUrlValidator classified a push-notification webhook host in two places that did not agree : a host...

org.apache.camel.quarkus:camel-quarkus-a2a (>=3.38.0, <=3.40.0), org.apache.camel.quarkus:camel-quarkus-a2a-deployment (>=3.38.0, <=3.40.0) +2 more potentially affected by CVE-2026-71569 via org.apache.camel:camel-a2a (>=4.21.0, <=4.22.1)

org.apache.camel:camel-a2a MAVEN version =4.21.0, =3.38.0, =3.38.0, =3.38.0, =3.40.0 - org.apache.camel.springboot:camel-a2a-starter 4.22.1 Source cves: CVE-2026-71569 Source advisory: MEND:CVE-2026-71569...

Apache Camel server request forgery vulnerability

Versions 4.21.0 through 4.22.2 of Apache Camel A2A contain a server-side request forgery vulnerability. This vulnerability stems from inconsistent classification of push notification webhooks by WebhookUrlValidator; the rules used to validate IP literals do not match those used for domain name...

io.dscope.camel:ag-ui-yaml-service (1.0.0), io.dscope.camel:camel-a2a-component (1.1.0) +8 more potentially affected by CVE-2026-56139 via org.apache.camel:camel-undertow (>=4.15.0, <=4.18.2)

org.apache.camel:camel-undertow MAVEN version =4.15.0, =1.3.0, =4.18.1, =4.15.0, =4.15.0, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-56139 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17874452...

io.dscope.camel:ag-ui-yaml-service (1.0.0), io.dscope.camel:camel-a2a-component (1.1.0) +8 more potentially affected by CVE-2026-56139 via org.apache.camel:camel-undertow (>=4.15.0, <=4.18.2)

org.apache.camel:camel-undertow MAVEN version =4.15.0, =1.3.0, =4.18.1, =4.15.0, =4.15.0, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-56139 Source advisory: OSV:GHSA-HJG2-F45W-C566...