CVE-2026-46456

CVE-2026-46456 — Inyección de encabezados de atributos de mensajes entrantes en camel-aws2-sqs Reproducciones de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, una por runtime:...

GHSA-CMC3-HR79-8MMV Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which blocks Camel, breadcrumbId and org.apache.camel. headers being written to t...