CVE-2026-85316 Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

CVE-2026-85316 Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

EUVD-2026-104194

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

com.codbex.atlas:codbex-atlas-application (>=2.85.0, <=2.109.0), com.codbex.iapetus:codbex-iapetus-application (>=2.64.0, <=2.73.0) +66 more potentially affected by CVE-2026-85254 via org.apache.camel:camel-platform-http (>=4.15.0, <=4.18.4)

org.apache.camel:camel-platform-http MAVEN version =4.15.0, =2.85.0, =2.64.0, =2.0.5, =2.0.5, =0.3.0, =1.0, =1.0, =0.7.1, =0.7.1, =0.7.1, =4.18.1, =3.29.0, =3.29.0, =3.33.3 and more Source cves: CVE-2026-85254 Source advisory: MEND:CVE-2026-85254...

com.codbex.atlas:codbex-atlas-application (>=2.110.0, <=14.56.0), com.codbex.iapetus:codbex-iapetus-application (>=2.74.0, <=2.76.0) +73 more potentially affected by CVE-2026-85254 via org.apache.camel:camel-platform-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http MAVEN version =4.19.0, =2.110.0, =2.74.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-85254 Source advisory: MEND:CVE-2026-85254...

CVE-2026-85254 Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

CVE-2026-85254

The Apache Camel Platform HTTP component is vulnerable to an improper handling of case sensitivity (CWE-178) in versions 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1. The root cause is that the guard intended to prevent request headers from being reflected into responses compares header names cas...

CVE-2026-85254

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

CVE-2026-85254 Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

CVE-2026-85254 Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

CVE-2026-85251

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

EUVD-2026-104192

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

com.cefriel:camel-chimera-graph (4.6.1), com.cefriel:camel-chimera-mapping-template (4.6.1) +42 more potentially affected by CVE-2026-85251 via org.apache.camel:camel-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-http MAVEN version =4.19.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =4.1.0 - org.apache.camel.kafkaconnector:camel-chuck-norris-source-kafka-connector 4.22.0 - org.apache.camel.kafkaconnector:camel-earthquake-source-kafka-connector 4.22.0 -...

ai.wanaku:wanaku-tool-service-http (>=0.1.1, <=0.2.0), io.camelbee:camelbee-quarkus-security (>=2.0.5, <=3.1.2) +39 more potentially affected by CVE-2026-85251 via org.apache.camel:camel-http (>=4.15.0, <=4.18.4)

org.apache.camel:camel-http MAVEN version =4.15.0, =0.1.1, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =1.3.0, =4.4.0, =4.4.0, =4.5.0 - org.apache.camel.kafkaconnector:camel-chuck-norris-source-kafka-connector 4.18.0 - org.apache.camel.kafkaconnector:camel-earthquake-source-kafka-connector 4.18.0 -...

CVE-2026-85251

The Apache Camel HTTP component (versions 4.0.0 to 4.18.5 and 4.19.0 to 4.22.1) contains a credential disclosure vulnerability when followRedirects=true. The root cause involves two paths where credentials—including OAuth2 Bearer tokens , Basic , and Digest credentials—are re-attached to redirect...

org.apache.camel.karaf:camel-knative-http (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-knative (>=3.29.0, <=3.33.3) +6 more potentially affected by CVE-2026-85247 via org.apache.camel:camel-knative-http (>=4.15.0, <=4.18.4)

org.apache.camel:camel-knative-http MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.33.3 Source cves: CVE-2026-85247 Source advisory: MEND:CVE-2026-85247...

org.apache.camel.quarkus:camel-quarkus-integration-test-knative (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-knative (>=3.35.0, <=3.39.0) +5 more potentially affected by CVE-2026-85247 via org.apache.camel:camel-knative-http (>=4.20.0, <=4.22.0)

org.apache.camel:camel-knative-http MAVEN version =4.20.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 Source cves: CVE-2026-85247 Source advisory: MEND:CVE-2026-85247...