EUVD-2026-104202

Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format...

EUVD-2026-104200

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85312

Apache Camel's Camel-Core component is vulnerable to Improper Input Validation (CWE-20) in versions 4.0.0 to 4.18.4, 4.19.0 to 4.22.0, and other versions prior to 4.23.0. The saga processor incorrectly processes the Long-Running-Action header because it lacks a Camel prefix, allowing it to bypass...

CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85301

The Apache Camel Keycloak component contains an Improper Authentication vulnerability (CWE-287) in versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.1. The security processor incorrectly skipped issuer validation when an introspection response omitted the iss claim, instead of treating the abs...

CVE-2026-85301 Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...

CVE-2026-85301 Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...

CVE-2026-85249 Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied...

CVE-2026-85249 Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied...

EUVD-2026-104190

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied...

CVE-2026-85249

The Apache Camel Tika component is vulnerable to a header injection flaw due to Improper Input Validation . The Tika producer maps every metadata key from a submitted document onto the Exchange as a header without filtering. Because document metadata is attacker-controlled, a crafted file can set...

CVE-2026-85249 Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied...

CVE-2026-85247 Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore

Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every...

CVE-2026-85247

The Apache Camel Knative component is vulnerable to improper certificate validation when SSL is enabled without a configured truststore. Affected versions include 4.0.0 to 4.18.5 (excluding 4.18.5), 4.19.0 to 4.22.1 (excluding 4.22.1), and versions prior to 4.23.0 . The root cause is a framework ...

EUVD-2026-104188

Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every...

CVE-2026-85247 Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore

Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every...

CVE-2026-85247 Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore

Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every...

EUVD-2026-104185

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

CVE-2026-112105

A vulnerability exists in GlitterWare Passy up to version 1.10.1 within the TLS Handler component. The root cause is improper certificate validation in the MyHttpOverrides function located in the lib/main.dart library. This flaw can be exploited remotely, though the attack is characterized by hig...