Apache Camel configuration error vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a configuration error vulnerability. This vulnerability stems from the createCorsHandler method in the Platform HTTP Vertx component, which sets Access-Control-Allow-Credentials to true beyond source checks...

Apache Camel encryption issue vulnerabilities

Versions of Apache Camel from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a security vulnerability related to encryption. This vulnerability arises when the Knative HTTP client enables SSL but does not configure a truststore. In such cases, the client options revert to trusti...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the Max-Age mechanism, which may cause overflows and skip closing connections. This could allow attackers to temporarily exhaust the connection po...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the lack of keepalive timeout handling during the initial request phase. Attackers can keep idle connections open without sending request data,...

Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5, as well as from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the Knative HTTP consumer, during processing failures, returns exception messages containing class names, messages, and stack traces...

Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain an information leakage vulnerability. This vulnerability stems from the fact that the OAuth2 client token in the HTTP component is cached globally on the JVM, and fields such as the request scope, resource indicator,...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability arises when an attacker can send an absolute-form request, causing Request.scheme to use the request-target scheme data controlled by the attacker...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper handling of HTTP header name case sensitivity. The protection mechanism that prevents request headers from being reflected in...

Google Agent Mesh Authorization Vulnerability

The Google Agent Mesh version 0.1.0-alpha.1 to 0.1.0-alpha.2 contains an authorization vulnerability. This vulnerability stems from the lack of key functionality for authentication and authorization in the/libp2p-http entry server. Biscuit tokens or grid registrations are not verified, resulting ...

Apache Camel input validation vulnerability

Versions of Apache Camel Netty HTTP from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability arises due to the camel-netty-http security constraint using case-sensitive matching when comparing the request path with the configure...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability stems from the use of a pure Python parser that accepts ambiguous HTTP request frames. This could allow unvalidated attackers to inject HTTP request...

Apache Camel information leakage vulnerability

Apache Camel HTTP versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the followRedirects=true parameter is used, and the OAuth2ClientConfigurer interceptor intercepts and matches AuthScope f...

Exploit for Improper Authentication in Apache Http_Server

CVE-2025-49812 분석 랩 — HTTP Desynchronization / 세션 하이재킹 교육·방...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

DEBIAN-CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-111999

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

UBUNTU-CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security TLS verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to...

EUVD-2026-103459

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...