CVE-2026-46454

camel-cometd Inbound Bayeux Header Injection Reproducer CVE-2026-46454 This project demonstrates a message-header injection in Apache Camel's camel-cometd component, tracked as CVE-2026-46454. The component maps inbound Bayeux CometD message headers into the Camel Exchange without...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.27.4) +3 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-cometd MAVEN version =4.0.0-m1, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.14.7 Source cves: CVE-2026-46454 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892575...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cometd MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46454 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892575...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cometd MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46454 Source advisory: OSV:GHSA-R9CC-J7WR-P329...

Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cometd MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46454 Source advisory: GHSA-R9CC-J7WR-P329...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cometd MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46454 Source advisory: GHSA-R9CC-J7WR-P329...

GHSA-R9CC-J7WR-P329 Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

org.apache.camel.karaf:camel-cometd (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cometd MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46454 Source advisory: OSV:GHSA-R9CC-J7WR-P329...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cometd MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46454 Source advisory: OSV:GHSA-R9CC-J7WR-P329...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cometd MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46454 Source advisory: MEND:CVE-2026-46454...

CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

org.apache.camel.karaf:camel-cometd (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-46454 via org.apache.camel:camel-cometd (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cometd MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46454 Source advisory: MEND:CVE-2026-46454...

CVE-2026-46454

The Apache Camel Cometd Component suffers from an improper input validation vulnerability (CWE-20) where it fails to apply a HeaderFilterStrategy when mapping inbound Bayeux (CometD) message headers into the Camel Exchange. Specifically, the CometdBinding.populateExchangeFromMessage (or createCam...

CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

PT-2026-55889

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Apache Camel Cometd component allows unauthenticated users to injec...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: SNYK:JAVA-ORGCOMETDJAVA-17729650...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: SNYK:JAVA-ORGCOMETDJAVA-17729650...