oscerd opened a new pull request, #1818: URL: https://github.com/apache/camel-website/pull/1818
Adds the security advisory pages for 38 Apache Camel CVEs (13 HIGH, 25 MEDIUM), all fixed in 4.18.5, 4.22.1 and 4.23.0. | CVE | Component | Issue | Severity | Fix | | --- | --- | --- | --- | --- | | CVE-2026-78162 | Camel-Hazelcast | Incomplete fix for CVE-2026-43865: two Camel-built configurations still had no Java deserialization filter (CWE-502) | MEDIUM | [CAMEL-24413](https://issues.apache.org/jira/browse/CAMEL-24413), [CAMEL-24420](https://issues.apache.org/jira/browse/CAMEL-24420), [#25566](https://github.com/apache/camel/pull/25566), [#25595](https://github.com/apache/camel/pull/25595) | | CVE-2026-78163 | Camel-Docling | Unvalidated message body input source enables server-side request forgery and local file disclosure (CWE-918, CWE-22, CWE-200) | MEDIUM | [CAMEL-24422](https://issues.apache.org/jira/browse/CAMEL-24422), [#25596](https://github.com/apache/camel/pull/25596) | | CVE-2026-78164 | Camel HTTP producers | Property placeholders were resolved on the message-supplied CamelHttpUri and CamelRestHttpUri override headers (CWE-1336, CWE-200) | HIGH | [CAMEL-24418](https://issues.apache.org/jira/browse/CAMEL-24418), [#25571](https://github.com/apache/camel/pull/25571) | | CVE-2026-78165 | Camel-Spring-Redis | Default JdkSerializationRedisSerializer deserialized Redis payloads without an ObjectInputFilter (CWE-502) | HIGH | [CAMEL-24421](https://issues.apache.org/jira/browse/CAMEL-24421), [#25587](https://github.com/apache/camel/pull/25587) | | CVE-2026-79983 | Camel-FTP | Path traversal through entries in the server directory listing (CWE-22) | HIGH | [CAMEL-24487](https://issues.apache.org/jira/browse/CAMEL-24487), [#25730](https://github.com/apache/camel/pull/25730) | | CVE-2026-79984 | Camel-Mina-SFTP | Path traversal through entries in the server directory listing (CWE-22) | HIGH | [CAMEL-24487](https://issues.apache.org/jira/browse/CAMEL-24487), [#25730](https://github.com/apache/camel/pull/25730) | | CVE-2026-79985 | Camel-SMB | Path traversal through entries in the share listing (CWE-22) | HIGH | [CAMEL-24487](https://issues.apache.org/jira/browse/CAMEL-24487), [#25730](https://github.com/apache/camel/pull/25730) | | CVE-2026-79986 | Camel-Azure-Files | Path traversal through entries in the share listing (CWE-22) | HIGH | [CAMEL-24487](https://issues.apache.org/jira/browse/CAMEL-24487), [#25730](https://github.com/apache/camel/pull/25730) | | CVE-2026-80312 | Camel-OAuth | Authentication bypass (CWE-287) | HIGH | [CAMEL-24411](https://issues.apache.org/jira/browse/CAMEL-24411), [#25567](https://github.com/apache/camel/pull/25567) | | CVE-2026-80343 | Camel-Netty-HTTP | Security constraint bypass (CWE-178) | HIGH | [CAMEL-24412](https://issues.apache.org/jira/browse/CAMEL-24412), [#25578](https://github.com/apache/camel/pull/25578) | | CVE-2026-80344 | Camel-AS2 | Server-side request forgery and credential disclosure (CWE-918) | HIGH | [CAMEL-24417](https://issues.apache.org/jira/browse/CAMEL-24417), [#25637](https://github.com/apache/camel/pull/25637) | | CVE-2026-83531 | Camel-Dynamic-Router | Subscription predicate and expression language were taken from the control message (CWE-94, CWE-917) | HIGH | [CAMEL-24576](https://issues.apache.org/jira/browse/CAMEL-24576), [#25992](https://github.com/apache/camel/pull/25992) | | CVE-2026-84176 | Camel-Platform-HTTP-Vertx | Cross-origin credential exposure (CWE-942) | MEDIUM | [CAMEL-24436](https://issues.apache.org/jira/browse/CAMEL-24436), [#25820](https://github.com/apache/camel/pull/25820) | | CVE-2026-84178 | Camel-OAuth | Login cross-site request forgery (CWE-352) | MEDIUM | [CAMEL-24437](https://issues.apache.org/jira/browse/CAMEL-24437), [#25821](https://github.com/apache/camel/pull/25821) | | CVE-2026-84180 | Camel-Knative | Information disclosure (CWE-209) | MEDIUM | [CAMEL-24428](https://issues.apache.org/jira/browse/CAMEL-24428), [#25685](https://github.com/apache/camel/pull/25685) | | CVE-2026-84181 | Camel-Shiro | Authentication bypass (CWE-287) | MEDIUM | [CAMEL-24439](https://issues.apache.org/jira/browse/CAMEL-24439), [#25822](https://github.com/apache/camel/pull/25822) | | CVE-2026-85243 | Camel-Crypto-PGP | Integrity verification downgrade (CWE-354) | MEDIUM | [CAMEL-24441](https://issues.apache.org/jira/browse/CAMEL-24441), [#25848](https://github.com/apache/camel/pull/25848) | | CVE-2026-85245 | Camel-Thrift | Cross-exchange data disclosure (CWE-488) | MEDIUM | [CAMEL-24442](https://issues.apache.org/jira/browse/CAMEL-24442), [#25823](https://github.com/apache/camel/pull/25823) | | CVE-2026-85246 | Camel-Mina | Information disclosure (CWE-209) | MEDIUM | [CAMEL-24476](https://issues.apache.org/jira/browse/CAMEL-24476), [#25741](https://github.com/apache/camel/pull/25741) | | CVE-2026-85247 | Camel-Knative | Improper certificate validation (CWE-295) | MEDIUM | [CAMEL-24443](https://issues.apache.org/jira/browse/CAMEL-24443), [#25824](https://github.com/apache/camel/pull/25824) | | CVE-2026-85248 | Camel-PQC | Signature verification bypass (CWE-362) | MEDIUM | [CAMEL-24445](https://issues.apache.org/jira/browse/CAMEL-24445), [#25825](https://github.com/apache/camel/pull/25825) | | CVE-2026-85249 | Camel-Tika | Header injection (CWE-20) | MEDIUM | [CAMEL-24423](https://issues.apache.org/jira/browse/CAMEL-24423), [#25819](https://github.com/apache/camel/pull/25819) | | CVE-2026-85250 | Camel-XPath | XML external entity processing (CWE-611) | HIGH | [CAMEL-24475](https://issues.apache.org/jira/browse/CAMEL-24475), [#25683](https://github.com/apache/camel/pull/25683) | | CVE-2026-85251 | Camel-HTTP | Credential disclosure (CWE-200) | HIGH | [CAMEL-24452](https://issues.apache.org/jira/browse/CAMEL-24452), [#25830](https://github.com/apache/camel/pull/25830) | | CVE-2026-85254 | Camel-Platform-HTTP | Request-header echo suppression bypass (CWE-178) | MEDIUM | [CAMEL-24453](https://issues.apache.org/jira/browse/CAMEL-24453), [#25831](https://github.com/apache/camel/pull/25831) | | CVE-2026-85257 | Camel-CXF | Information disclosure (CWE-209) | MEDIUM | [CAMEL-24477](https://issues.apache.org/jira/browse/CAMEL-24477), [#25742](https://github.com/apache/camel/pull/25742) | | CVE-2026-85260 | Camel-MLLP | Protected health information disclosure (CWE-532) | MEDIUM | [CAMEL-24454](https://issues.apache.org/jira/browse/CAMEL-24454), [#25832](https://github.com/apache/camel/pull/25832) | | CVE-2026-85296 | Camel-AS2 | Cross-partner signing key confusion (CWE-488) | MEDIUM | [CAMEL-24429](https://issues.apache.org/jira/browse/CAMEL-24429), [#25641](https://github.com/apache/camel/pull/25641) | | CVE-2026-85300 | Camel-PQC | Private key disclosure (CWE-276) | MEDIUM | [CAMEL-24447](https://issues.apache.org/jira/browse/CAMEL-24447), [#25826](https://github.com/apache/camel/pull/25826) | | CVE-2026-85301 | Camel-Keycloak | Issuer validation bypass (CWE-287) | MEDIUM | [CAMEL-24448](https://issues.apache.org/jira/browse/CAMEL-24448), [#25827](https://github.com/apache/camel/pull/25827) | | CVE-2026-85312 | Camel-Core | Saga hijacking (CWE-20) | MEDIUM | [CAMEL-24449](https://issues.apache.org/jira/browse/CAMEL-24449), [#25828](https://github.com/apache/camel/pull/25828) | | CVE-2026-85313 | Camel-Jetty | Cross-origin credential exposure (CWE-942) | MEDIUM | [CAMEL-24450](https://issues.apache.org/jira/browse/CAMEL-24450), [#25829](https://github.com/apache/camel/pull/25829) | | CVE-2026-85314 | Camel-Mail | Header injection (CWE-20) | MEDIUM | [CAMEL-24419](https://issues.apache.org/jira/browse/CAMEL-24419), [#25568](https://github.com/apache/camel/pull/25568) | | CVE-2026-85315 | Camel-gRPC | Information disclosure (CWE-209) | MEDIUM | [CAMEL-24478](https://issues.apache.org/jira/browse/CAMEL-24478), [#25839](https://github.com/apache/camel/pull/25839) | | CVE-2026-85316 | Camel-Platform-HTTP | Unintended proxy mode (CWE-1220) | MEDIUM | [CAMEL-24455](https://issues.apache.org/jira/browse/CAMEL-24455), [#25833](https://github.com/apache/camel/pull/25833) | | CVE-2026-85317 | Camel-HTTP | OAuth2 token confusion (CWE-524) | MEDIUM | [CAMEL-24456](https://issues.apache.org/jira/browse/CAMEL-24456), [#25834](https://github.com/apache/camel/pull/25834) | | CVE-2026-88901 | Camel-Smooks | XML external entity processing (CWE-611) | HIGH | [CAMEL-24677](https://issues.apache.org/jira/browse/CAMEL-24677), [#26270](https://github.com/apache/camel/pull/26270) | | CVE-2026-91858 | Camel-FOP | XML external entity processing (CWE-611) | MEDIUM | [CAMEL-24605](https://issues.apache.org/jira/browse/CAMEL-24605), [#26108](https://github.com/apache/camel/pull/26108) | All three fixed releases are out: 4.22.1 on 2026-09-17, 4.18.5 on 2026-10-11 and 4.23.0 on 2026-10-15. Each advisory states per-branch affected ranges closing at 4.18.5 and 4.22.1, the two maintained lines, with 4.23.0 carrying the fix on main. CVE-2026-79983 to CVE-2026-79986 share a single fix (CAMEL-24487) in the remote-file consumers and are published as one advisory per affected component. Every page is dated 2026-10-15, the publication day, and each `.md` ships with its matching clearsigned `.txt.asc`, as with the existing advisories. The CVE records are published separately through the ASF CVE tool. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
