CVE-2026-48203

CVE-2026-48203 — camel-solr SolrParam. / SolrField. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel...

camel-solr: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

A flaw was found in the Apache Camel Solr component. A remote unauthenticated attacker can inject Solr query parameters and document fields into requests by utilizing specific header prefixes SolrParam. and SolrField. that bypass the HTTP header filter. This improper input validation allows for...

camel-solr SSRF Unauthorized Access

The vulnerability of the camel-solr component of the Apache Camel Java framework is related to incorrect elimination of certain elements in the output data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information or perform a SSRF attack...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (>=4.11.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (>=4.11.0, <=4.14.5) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.8.0, <=4.14.7)

org.apache.camel:camel-solr MAVEN version =4.8.0, =4.11.0, =4.11.0, =4.8.1, =3.19.0, =3.19.0, =3.19.0, =4.8.0, =4.14.7 Source cves: CVE-2026-48203 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879229...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-solr MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48203 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879229...

org.apache.camel.quarkus:camel-quarkus-integration-test-solr (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-solr (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-solr MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48203 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879229...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the improper handling of HTTP headers with the SolrParam. and SolrField. prefixes. An attacker can manipulate Solr query parameters or...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (>=4.11.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (>=4.11.0, <=4.14.5) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.8.0, <=4.14.7)

org.apache.camel:camel-solr MAVEN version =4.8.0, =4.11.0, =4.11.0, =4.8.1, =3.19.0, =3.19.0, =3.19.0, =4.8.0, =4.14.7 Source cves: CVE-2026-48203 Source advisory: GHSA-4H4F-V54Q-7PQ8...

org.apache.camel.quarkus:camel-quarkus-integration-test-solr (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-solr (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-solr MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48203 Source advisory: GHSA-4H4F-V54Q-7PQ8...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (>=4.11.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (>=4.11.0, <=4.14.5) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.8.0, <=4.14.7)

org.apache.camel:camel-solr MAVEN version =4.8.0, =4.11.0, =4.11.0, =4.8.1, =3.19.0, =3.19.0, =3.19.0, =4.8.0, =4.14.7 Source cves: CVE-2026-48203 Source advisory: OSV:GHSA-4H4F-V54Q-7PQ8...

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-solr MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48203 Source advisory: GHSA-4H4F-V54Q-7PQ8...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-solr MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48203 Source advisory: OSV:GHSA-4H4F-V54Q-7PQ8...

GHSA-4H4F-V54Q-7PQ8 Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam...

org.apache.camel.quarkus:camel-quarkus-integration-test-solr (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-solr (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-solr MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48203 Source advisory: OSV:GHSA-4H4F-V54Q-7PQ8...

CVE-2026-48203

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (>=4.11.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (>=4.11.0, <=4.14.5) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.8.0, <=4.14.7)

org.apache.camel:camel-solr MAVEN version =4.8.0, =4.11.0, =4.11.0, =4.8.1, =3.19.0, =3.19.0, =3.19.0, =4.8.0, =4.14.7 Source cves: CVE-2026-48203 Source advisory: MEND:CVE-2026-48203...

org.apache.camel.kafkaconnector:camel-solr-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-solr-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-solr MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-48203 Source advisory: MEND:CVE-2026-48203...

CVE-2026-48203 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Improper Input Validation, Server-Side Request Forgery SSRF vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam...

org.apache.camel.quarkus:camel-quarkus-integration-test-solr (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-solr (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-48203 via org.apache.camel:camel-solr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-solr MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-48203 Source advisory: MEND:CVE-2026-48203...