org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...

External Control of Assumed-Immutable Web Parameter

Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...

GHSA-V7H8-XHH6-GFJ4 Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...

GHSA-M5R8-W65Q-8WJF Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...

org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)

org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

CVE-2026-78329

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...

CVE-2026-71300

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

daphne: daphne: Denial of Service via excessive WebSocket message size

A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service DoS for the affected system...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

CVE-2026-78329 Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...

EUVD-2026-64962

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...