CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85312

Apache Camel's Camel-Core component is vulnerable to Improper Input Validation (CWE-20) in versions 4.0.0 to 4.18.4, 4.19.0 to 4.22.0, and other versions prior to 4.23.0. The saga processor incorrectly processes the Long-Running-Action header because it lacks a Camel prefix, allowing it to bypass...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Camel-core (CVE-2020-11971)

Summary Rebind Flaw vulnerability in Camel-core may affect IBM Spectrum Control. CVE-2020-11971. Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrad...

br.com.senior:crm-http-camel-api (>=0.0.2-alpha, <=0.0.81-alpha), br.com.senior:novasoft-http-camel-api (>=0.0.3-alpha, <=0.0.93-alpha) +2844 more potentially affected by CVE-2025-27636 via org.apache.camel:camel-support (>=3.10.0, <=3.22.3)

org.apache.camel:camel-support MAVEN version =3.10.0, =0.0.2-alpha, =0.0.3-alpha, =0.0.1-alpha, =1.0.0-alpha-1, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =18.4.0, =18.4.0, =24.17.0 and more Source cves: CVE-2025-27636 Source advisory:...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.33.0 security update & enhancements

Release of OpenShift Serverless Logic 1.33.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +622 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=3.0.0, <=3.21.3)

org.apache.camel:camel-core MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m1, =3.0.0, =3.0.0, =1.0.3, =3.11.0, =1.5, =1.21 and more Source cves: CVE-2024-22371 Source advisory: GHSA-QPXM-689R-3849...

org.apache.camel.karaf:camel-commands-core (3.22.0), org.apache.camel.karaf:camel-karaf-commands (3.22.0) +14 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (3.22.0)

org.apache.camel:camel-core MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-commands-core 3.22.0 - org.apache.camel.karaf:camel-karaf-commands 3.22.0 -...

com.artnaseef:correlation-id-utils-camel-v4 (2.4.0), de.ikor.sip.foundation:sip-integration-starter (>=3.3.0, <=3.5.0) +22 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.1.0, <=4.3.0)

org.apache.camel:camel-core MAVEN version =4.1.0, =3.3.0, =3.3.0, =3.3.0, =6.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.3.0 and more Source cves: CVE-2024-22371 Source advisory: OSV:GHSA-QPXM-689R-3849...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +622 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=3.0.0, <=3.21.3)

org.apache.camel:camel-core MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m1, =3.0.0, =3.0.0, =1.0.3, =3.11.0, =1.5, =1.21 and more Source cves: CVE-2024-22371 Source advisory: OSV:GHSA-QPXM-689R-3849...

org.apache.camel.karaf:camel-commands-core (3.22.0), org.apache.camel.karaf:camel-karaf-commands (3.22.0) +14 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (3.22.0)

org.apache.camel:camel-core MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-commands-core 3.22.0 - org.apache.camel.karaf:camel-karaf-commands 3.22.0 -...

com.artnaseef:correlation-id-utils-camel-v4 (2.4.0), de.ikor.sip.foundation:sip-integration-starter (>=3.3.0, <=3.5.0) +22 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.1.0, <=4.3.0)

org.apache.camel:camel-core MAVEN version =4.1.0, =3.3.0, =3.3.0, =3.3.0, =6.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.3.0 and more Source cves: CVE-2024-22371 Source advisory: GHSA-QPXM-689R-3849...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +622 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=3.0.0, <=3.21.3)

org.apache.camel:camel-core MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m1, =3.0.0, =3.0.0, =1.0.3, =3.11.0, =1.5, =1.21 and more Source cves: CVE-2024-22371 Source advisory: MEND:CVE-2024-22371...

com.artnaseef:correlation-id-utils-camel-v4 (2.4.0), de.ikor.sip.foundation:sip-integration-starter (>=3.3.0, <=3.5.0) +22 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.1.0, <=4.3.0)

org.apache.camel:camel-core MAVEN version =4.1.0, =3.3.0, =3.3.0, =3.3.0, =6.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.3.0 and more Source cves: CVE-2024-22371 Source advisory: MEND:CVE-2024-22371...

org.apache.camel.karaf:camel-commands-core (3.22.0), org.apache.camel.karaf:camel-karaf-commands (3.22.0) +14 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (3.22.0)

org.apache.camel:camel-core MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel.karaf:camel-commands-core 3.22.0 - org.apache.camel.karaf:camel-karaf-commands 3.22.0 -...

de.ikor.sip.foundation:sip-integration-starter (3.2.0), de.ikor.sip.foundation:sip-security (3.2.0) +95 more potentially affected by CVE-2024-22371 via org.apache.camel:camel-core (>=4.0.0, <=4.0.3)

org.apache.camel:camel-core MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 and...

Security Bulletin: Apache Camel Core vulnerability in IBM Tivoli Monitoring Data Provider (CVE-2020-11971)

Summary IBM Tivoli Monitoring Data provider is vulnerable to Apache Camel Core vulnerabilty CVE-2020-11971 Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel could allow a remote attacker to obtain sensitive information, caused by a rebind flaw in JMX. By sending a...

org.apache.camel:camel-activemq (1.1.0), org.apache.camel:camel-bam (1.1.0) +23 more potentially affected by CVE-2013-4330 via org.apache.camel:camel-core (1.1.0)

org.apache.camel:camel-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-activemq 1.1.0 - org.apache.camel:camel-bam 1.1.0 - org.apache.camel:camel-cxf 1.1...

com.webtide.hightide:auctiondemo (6.1h.8), com.webtide.hightide:hightide-resources (6.1h.8) +67 more potentially affected by CVE-2013-4330 via org.apache.camel:camel-core (1.2.0)

org.apache.camel:camel-core MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - com.webtide.hightide:auctiondemo 6.1h.8 - com.webtide.hightide:hightide-resources 6.1h.8 -...

com.googlecode.mycontainer:mycontainer-jms (>=1.2.29, <=1.7.5), com.webtide.hightide:auctiondemo (6.1h.10) +92 more potentially affected by CVE-2013-4330 via org.apache.camel:camel-core (1.3.0)

org.apache.camel:camel-core MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - com.googlecode.mycontainer:mycontainer-jms =1.2.29, =1.0.1, =2.7.0 -...

org.apache.camel:camel-amqp (1.4.0), org.apache.camel:camel-atom (1.4.0) +58 more potentially affected by CVE-2013-4330 via org.apache.camel:camel-core (1.4.0)

org.apache.camel:camel-core MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-amqp 1.4.0 - org.apache.camel:camel-atom 1.4.0 - org.apache.camel:camel-bam 1.4.0 ...