Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5, as well as from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the Knative HTTP consumer, during processing failures, returns exception messages containing class names, messages, and stack traces...

Apache Camel permission and access control vulnerabilities

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain vulnerabilities related to permission handling and access control. These vulnerabilities arise from the Platform HTTP component, which determines whether endpoints run in proxy mode by checking whether a path starts...

Apache Camel information leakage vulnerability

Apache Camel HTTP versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the followRedirects=true parameter is used, and the OAuth2ClientConfigurer interceptor intercepts and matches AuthScope f...

Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain an information leakage vulnerability. This vulnerability stems from the fact that the OAuth2 client token in the HTTP component is cached globally on the JVM, and fields such as the request scope, resource indicator,...

Exploit for Improper Authentication in Apache Http_Server

CVE-2025-49812 분석 랩 — HTTP Desynchronization / 세션 하이재킹 교육·방...

DEBIAN-CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-111999

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

UBUNTU-CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security TLS verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

a2a-server (>=0.1.2, <=0.6.1), aef-framework (>=0.1.1, <=0.1.2) +121 more potentially affected by CVE-2026-112006 via opentelemetry-exporter-otlp-proto-http (1.44.0)

opentelemetry-exporter-otlp-proto-http PYPI version 1.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on opentelemetry-exporter-otlp-proto-http and may be impacted: - a2a-server =0.1.2, =0.1.1, =0.0.122, =0.105.1, =0.10.0, =0.10.0, =1.8.1, =1.0.0b2,...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

The opentelemetry-exporter-otlp-proto-http library (versions 1.5.0 before 1.45.0) is vulnerable to improper certificate validation . The root cause is that TLS verification is disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are provided as empty strings. This allows man-in-the-middle a...

EUVD-2026-103459

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...