CVE-2026-63621

CVE-2026-63621 — camel-knative 構造化 CloudEvent ヘッダーインジェクション 同じ Apache Camel 脆弱性の実行可能な概念実証（PoC）再現プログラムです。ランタイムごとに1つ用意されています: ランタイム| ディレクトリ| スタック| スタイル ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-knative 4.18.2| 直接デコード（注記参照） Camel Quarkus| camel-quarkus/| Quarku...

org.apache.camel/camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery

A flaw was found in Apache Camel Knative component. The Knative consumer in camel-knative improperly handles CloudEvent extension fields in structured content mode, copying them directly into message headers without proper filtering. This allows an unauthenticated attacker to inject internal Came...

CVE-2026-63621

A flaw was found in Apache Camel Knative component. The Knative consumer in camel-knative improperly handles CloudEvent extension fields in structured content mode, copying them directly into message headers without proper filtering. This allows an unauthenticated attacker to inject internal Came...

Header Injection

Apache Camel Knative component is vulnerable to Header Injection. The vulnerability is due to structured CloudEvent extension fields being copied into Exchange headers without filtering, allowing an attacker to inject Camel-internal headers and influence downstream components, potentially enablin...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the process that maps CloudEvent extension fields onto message headers without applying any header filter strategy in structured content...

GHSA-VVWM-3J43-7PFM Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

CVE-2026-63621

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

CVE-2026-63621 Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

CVE-2026-63621

The Apache Camel Knative component is vulnerable to an injection flaw (CWE-20, CWE-74) due to improper input validation in structured content mode (application/cloudevents+json). While binary content mode filters headers, structured mode copies all CloudEvent extension fields directly into Camel ...

CVE-2026-63621 Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

EUVD-2026-64960

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

Exploit for CVE-2026-63621

CVE-2026-63621 — camel-knative structured CloudEvent header in...

PT-2026-80927

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

The vulnerabilities of the components camel-knative-http, camel-cxf-rest, and camel-cxf-transport from the Apache Camel framework allow attackers to execute arbitrary code or gain unauthorized access during write operations.

The vulnerability of the camel-knative-http, camel-cxf-rest, and camel-cxf-transport components of the Apache Camel framework is related to deficiencies in the mechanism for processing registry-dependent data. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain...

Improper Validation of Unsafe Equivalence in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the CXF-RS or CXF-SOAP endpoints due to missing inbound filtering via setInFilterStartsWith. An attacker can execute arbitrary code and write files by injecting Camel-internal header...

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http only...

CVE-2026-47323 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http only...

CVE-2026-47323

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http only...

CVE-2026-47323: Improper Handling of Case Sensitivity

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http only...