149071 matches found
CVE-2026-84176
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...
CVE-2026-78164
Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...
CVE-2026-112103
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...
python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...
Important: Red Hat Security Advisory: pcs security update
An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)
Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...
CVE-2026-85317
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
com.cefriel:camel-chimera-graph (4.6.1), com.cefriel:camel-chimera-mapping-template (4.6.1) +42 more potentially affected by CVE-2026-85317 via org.apache.camel:camel-http (>=4.19.0, <=4.22.0)
org.apache.camel:camel-http MAVEN version =4.19.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =4.1.0 - org.apache.camel.kafkaconnector:camel-chuck-norris-source-kafka-connector 4.22.0 - org.apache.camel.kafkaconnector:camel-earthquake-source-kafka-connector 4.22.0 -...
CVE-2026-85317
The Apache Camel HTTP component is vulnerable to an OAuth2 Token Confusion issue due to an under-keyed JVM-global token cache. Specifically, the cache key omits the requested scope , resource indicator , and token endpoint , causing multiple distinct endpoints to share the same cache entry. This ...
EUVD-2026-104205
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
CVE-2026-85317 Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
CVE-2026-85317 Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
CVE-2026-85317 Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
ai.wanaku:wanaku-tool-service-http (>=0.1.1, <=0.2.0), io.camelbee:camelbee-quarkus-security (>=2.0.5, <=3.1.2) +39 more potentially affected by CVE-2026-85317 via org.apache.camel:camel-http (>=4.15.0, <=4.18.4)
org.apache.camel:camel-http MAVEN version =4.15.0, =0.1.1, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =1.3.0, =4.4.0, =4.4.0, =4.5.0 - org.apache.camel.kafkaconnector:camel-chuck-norris-source-kafka-connector 4.18.0 - org.apache.camel.kafkaconnector:camel-earthquake-source-kafka-connector 4.18.0 -...
com.codbex.atlas:codbex-atlas-application (>=2.85.0, <=2.109.0), com.codbex.iapetus:codbex-iapetus-application (>=2.64.0, <=2.73.0) +66 more potentially affected by CVE-2026-85316 via org.apache.camel:camel-platform-http (>=4.15.0, <=4.18.4)
org.apache.camel:camel-platform-http MAVEN version =4.15.0, =2.85.0, =2.64.0, =2.0.5, =2.0.5, =0.3.0, =1.0, =1.0, =0.7.1, =0.7.1, =0.7.1, =4.18.1, =3.29.0, =3.29.0, =3.33.3 and more Source cves: CVE-2026-85316 Source advisory: MEND:CVE-2026-85316...
CVE-2026-85316
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...
com.codbex.atlas:codbex-atlas-application (>=2.110.0, <=14.56.0), com.codbex.iapetus:codbex-iapetus-application (>=2.74.0, <=2.76.0) +73 more potentially affected by CVE-2026-85316 via org.apache.camel:camel-platform-http (>=4.19.0, <=4.22.0)
org.apache.camel:camel-platform-http MAVEN version =4.19.0, =2.110.0, =2.74.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-85316 Source advisory: MEND:CVE-2026-85316...
EUVD-2026-104204
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...
CVE-2026-85316 Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...
CVE-2026-85316
The Apache Camel Platform HTTP component contains an Insufficient Granularity of Access Control vulnerability (CWE-1220). The issue stems from the component identifying proxy mode by checking if a configured path starts with the string proxy using prefix matching, rather than an exact match. Cons...