announce  

Messages by Thread

• CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths Joerg Hoh via announce
• [ANNOUNCE] Apache OFBiz 24.09.08 released Jacopo Cappellato via announce
• CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation Christopher L. Shannon via announce
• CVE-2026-103864: Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization Joerg Hoh via announce
• CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling Joerg Hoh via announce
• [ANNOUNCE] Apache Arrow 26.0.1 released Raúl Cumplido via announce
• CVE-2026-59267: Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption Arrigo Marchiori via announce
• CVE-2026-90626: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files Arrigo Marchiori via announce
• [ANNOUNCE] Apache Iceberg Terraform Provider v0.2.0 released Matt Topol via announce
• CVE-2026-115448: Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable Andor Molnar via announce
• CVE-2026-59264: Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer Arrigo Marchiori via announce
• CVE-2026-59263: Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt. Arrigo Marchiori via announce
• CVE-2026-90629: Apache OpenOffice: Out of bounds memory access during WMF import Arrigo Marchiori via announce
• CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader Arrigo Marchiori via announce
• CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability Arrigo Marchiori via announce
• CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables Arrigo Marchiori via announce
• CVE-2026-90634: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files Arrigo Marchiori via announce
• CVE-2026-90628: Apache OpenOffice: Stack overflow in CFF hint handling Arrigo Marchiori via announce
• CVE-2026-90632: Apache OpenOffice: Local file inclusion via GStreamer plugin Arrigo Marchiori via announce
• CVE-2026-82898: Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in Emond Papegaaij via announce
• CVE-2026-103582: Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS) Christopher L. Shannon via announce
• CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling Andor Molnar via announce
• CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread Andor Molnar via announce
• CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation Andor Molnar via announce
• [ANNOUNCE] Apache Juneau 9.2.1 released James Bognar via announce
• CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection Matt Pavlovich via announce
• [ANNOUNCE] Apache Casbin (Incubating) JCasbin 1.100.0 Yanrui Zhang via announce
• CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal Christopher L. Shannon via announce
• CVE-2026-114442: Apache HertzBeat: incomplete XPath expression validation in aliasFields Qingran Zhao via announce
• CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership Arnout Engelen via announce
• [ANNOUNCE] Apache Geronimo Mail 1.1.1 released Richard Zowalla via announce
• CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads Jeffrey Vo via announce
• [ANN] Apache Syncope 4.1.4 Francesco Chicchiriccò via announce
• CVE-2026-82956: Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name Emond Papegaaij via announce
• CVE-2026-82840: Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication Emond Papegaaij via announce
• [ANN] Apache Syncope 4.0.9 Francesco Chicchiriccò via announce
• CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update Francesco Chicchiriccò via announce
• CVE-2026-83539: Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data Emond Papegaaij via announce
• CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search Francesco Chicchiriccò via announce
• CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing Arnout Engelen via announce
• CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update Francesco Chicchiriccò via announce
• CVE-2026-82115: Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource Emond Papegaaij via announce
• CVE-2026-111089: Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup Emond Papegaaij via announce
• [ANNOUNCE] Apache UIMA Java SDK version 3.7.0 released Richard Eckart de Castilho via announce
• [ANNOUNCE] Apache Wicket 11.0.0 released Martijn Dashorst via announce
• CVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expression Francesco Chicchiriccò via announce
• CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass Francesco Chicchiriccò via announce
• CVE-2026-87718: Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates Emond Papegaaij via announce
• [ANNOUNCE] Hertzbeat 1.9.1 released zhaoqingran.apache.org via announce
• CVE-2026-84177: Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore Emond Papegaaij via announce
• CVE-2026-84172: Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader Emond Papegaaij via announce
• CVE-2026-83594: Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names Emond Papegaaij via announce
• CVE-2026-82559: Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation Emond Papegaaij via announce
• CVE-2026-83559: Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal Emond Papegaaij via announce
• CVE-2026-82705: Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component Emond Papegaaij via announce
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-29 and 2026-10-31 are released Hussein Awala via announce
• CVE-2026-84231: Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag Emond Papegaaij via announce
• CVE-2026-84170: Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource Emond Papegaaij via announce
• CVE-2026-95863: Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup Emond Papegaaij via announce
• [ANNOUNCE] Apache Wicket 10.12.0 (LTS) is released Martijn Dashorst via announce
• CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder Emmanuel Lécharny via announce
• CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default Jens Geyer via announce
• [ANNOUNCE] Apache Lucene 10.6.0 released Houston Putman via announce
• CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup() Yash Mayya
• [ANNOUNCE] Apache Solr 10.1.0 released Andrzej Białecki
• [ANNOUNCE] Apache Teaclave™ TrustZone SDK 0.10.0 Released Zehui Chen
• [ANNOUNCE] Apache Maka 0.2.2 (incubating) released Yuhan Lei
• CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API Terence Monteiro
• CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints Terence Monteiro
• [ANNOUNCE] Apache DataSketches Rust 0.6.0 released tison
• [ANNOUNCE] Apache Wicket 8.20.0 marks the end of Wicket 8 Martijn Dashorst
• [ANNOUNCE] Apache Wicket 9.25.0 marks the end of Wicket 9 Martijn Dashorst
• [ANNOUNCE] Fineract 1.16.1 Release meonkeys
• [ANNOUNCE] Apache Tika 4.2.0 released Tim Allison
• [ANN] Apache Tomcat Native 1.3.10 released Mark Thomas
• [ANN] Apache Tomcat Native 2.0.17 released Mark Thomas
• [ANNOUNCE] Apache Pinot 1.6.0 released Xiang Fu
• CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured Manikumar
• [ANNOUNCE] Apache MINA SSHD 2.20.1 released Thomas Wolf
• [ANNOUNCE] Apache MINA SSHD 3.0.0-M7 released Thomas Wolf
• CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash Andrew Stitcher
• [ANNOUNCE] Apache Qpid Proton 0.41.1 released Andrew Stitcher
• CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. Andrew Stitcher
• CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames Andrew Stitcher
• CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read Andrew Stitcher
• CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches Manikumar
• CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default Manikumar
• CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. Manikumar
• CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint Manikumar
• [ANNOUNCE] Apache Axis2/Java 2.0.2 released robertlazarski
• CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs Manikumar
• CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers Manikumar
• CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions Manikumar
• CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation Manikumar
• CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation Manikumar
• CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service Manikumar
• CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing Manikumar
• [ANNOUNCE] Apache ActiveMQ 6.4.0 has been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache ActiveMQ 6.3.3 and 5.19.12 have been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache Kafka 4.3.2 Jiunn-Yang Huang
• [ANNOUNCE] Apache Arrow ADBC 25 Released David Li
• CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host Hussein Awala
• [ANNOUNCE] Apache Pulsar 5.0.1 released Lari Hotari
• [ANNOUNCEMENT] HttpComponents Client 5.7-beta1 Released Oleg Kalnichevski
• [ANNOUNCE] Apache Asyncband (Incubating) 0.7.4 released iqwqi
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-20 are released Hussein Awala
• [ANNOUNCE] Apache POI 6.0.0 release PJ Fanning
• CVE-2026-115721: Apache Vysper: Unbounded allocation Thomas Wolf
• CVE-2026-115748: Apache Vysper: Authorization bypass Thomas Wolf
• CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions Andrea Cosentino
• CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry Andrea Cosentino
• CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory Andrea Cosentino
• CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) Andrea Cosentino
• CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache Andrea Cosentino
• CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved Andrea Cosentino
• CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• [ANNOUNCE] Apache Camel 4.22.2 (LTS) Released Gregor Zurowski
• [ANNOUNCE] Release Apache Paimon Terraform 0.1.0 Jiajia Li
• CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing Piotr Karwasz
• CVE-2026-105869: Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role Lari Hotari
• CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands Lari Hotari
• CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization Lari Hotari
• CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life Lari Hotari
• CVE-2026-105930: Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download Lari Hotari
• CVE-2026-105927: Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission Lari Hotari
• CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint Lari Hotari
• CVE-2026-105932: Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints Lari Hotari
• CVE-2026-105934: Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic Lari Hotari
• CVE-2026-105937: Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data Lari Hotari
• CVE-2026-105942: Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation Lari Hotari
• CVE-2026-105935: Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission Lari Hotari
• CVE-2026-105931: Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants Lari Hotari
• CVE-2026-105938: Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all Lari Hotari
• CVE-2026-105945: Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage Lari Hotari
• CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation Haonan Hou
• CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Haonan Hou
• CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface Haonan Hou
• CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver Haonan Hou
• [ANNOUNCE] Apache Jackrabbit Oak 1.22.25 released Julian Reschke
• Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 Weibing Wang
• [ANNOUNCE] Apache BookKeeper 4.18.2 released Matteo Merli
• CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Jan Lehnardt
• [SECURITY] CVE-2026-101356 Apache Tomcat - HTTP/2 request/response mix-up after error during async processing Mark Thomas
• CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely Jan Lehnardt
• [ANNOUNCE] Apache Casbin SQLx Adapter (Incubating) 1.9.0 emryzhang
• [SECURITY] CVE-2026-74049 Apache Tomcat - Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) Mark Thomas
• [SECURITY] CVE-2026-74048 Apache Tomcat - OpenSSL-FFM FIPS failure does not prevent start-up Mark Thomas
• [SECURITY] CVE-2026-103119 Apache Tomcat - AJP response mix-up Mark Thomas
• [SECURITY] CVE-2026-101296 Apache Tomcat - JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Mark Thomas
• [SECURITY] CVE-2026-93446 Apache Tomcat - Possible TLS 1.3 connection failures Mark Thomas
• [SECURITY] CVE-2026-88041 Apache Tomcat - HTTP/2 trailer header cross-contamination Mark Thomas
• [SECURITY] CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Mark Thomas
• CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values Jan Lehnardt
• CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs Jan Lehnardt
• CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user Jan Lehnardt
• CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Jan Lehnardt
• CVE-2026-108087: Apache Cocoon: SQL Injection Arnout Engelen
• CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure Arnout Engelen
• CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces Arnout Engelen
• CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning Arnout Engelen
• [ANNOUNCE] Apache Jackrabbit Oak 2.8.0 released Julian Reschke
• CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation Adam Reeve
• [ANNOUNCE] Apache Commons JEXL 3.7.1 Gary Gregory
• CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account Jarek Potiuk
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-17 are released Jarek Potiuk
• [ANNOUNCE] Apache Arrow 26.0.0 released Raúl Cumplido
• CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Andrea Cosentino
• [ANNOUNCE] OpenDAL 0.59.5-rc.2 released xuanwo
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-14 are released Jarek Potiuk
• CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure Andrea Cosentino
• CVE-2026-85245: Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target Andrea Cosentino
• CVE-2026-108743: Apache Kylin: spark job OS command injection Li Yang
• CVE-2026-85249: Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata Andrea Cosentino
• CVE-2026-85251: Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets Andrea Cosentino
• CVE-2026-80312: Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors Andrea Cosentino
• CVE-2026-83531: Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages Andrea Cosentino
• [ANNOUNCE] Apache Johnzon 1.3.1 Markus Jung
• CVE-2026-71253: Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON Markus Jung
• CVE-2026-85300: Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions Andrea Cosentino
• CVE-2026-85254: Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing Andrea Cosentino
• CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set Andrea Cosentino
• CVE-2026-85314: Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) Andrea Cosentino
• CVE-2026-85317: Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache Andrea Cosentino
• CVE-2026-85260: Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default Andrea Cosentino
• CVE-2026-85257: Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State Andrea Cosentino
• CVE-2026-78165: Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads Andrea Cosentino
• CVE-2026-85246: Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-84181: Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse Andrea Cosentino
• CVE-2026-85248: Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance Andrea Cosentino
• CVE-2026-85247: Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore Andrea Cosentino
• CVE-2026-85301: Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim Andrea Cosentino
• CVE-2026-85250: Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option Andrea Cosentino
• CVE-2026-85312: Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header Andrea Cosentino
• CVE-2026-91858: Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present Andrea Cosentino
• CVE-2026-85315: Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-79986: Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-85316: Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching Andrea Cosentino
• CVE-2026-88901: Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default Andrea Cosentino
• CVE-2026-80343: Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching Andrea Cosentino

• Earlier messages