This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
The following commit(s) were added to refs/heads/main by this push:
new f7eca3eb chore: add the security advisory for CVE-2026-71569
(camel-a2a) (#1830)
f7eca3eb is described below
commit f7eca3eb3ce84b75e69180bbdfd70e39d294c9ce
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Oct 23 11:40:44 2026 +0200
chore: add the security advisory for CVE-2026-71569 (camel-a2a) (#1830)
WebhookUrlValidator classified a push notification webhook host in
two places that did not agree. An address reached through a host
name that resolved to an IPv6 unique local address (fc00::/7)
passed the guard, enabling blind server-side request forgery.
Fixed in 4.22.2 and 4.23.0 by CAMEL-24371. Both releases are on Maven
Central.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Antigravity <[email protected]>
---
content/security/CVE-2026-71569.md | 25 +++++++++++++++++++++
content/security/CVE-2026-71569.txt.asc | 39 +++++++++++++++++++++++++++++++++
2 files changed, 64 insertions(+)
diff --git a/content/security/CVE-2026-71569.md
b/content/security/CVE-2026-71569.md
new file mode 100644
index 00000000..b3af7791
--- /dev/null
+++ b/content/security/CVE-2026-71569.md
@@ -0,0 +1,25 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-71569"
+date: 2026-10-23T10:00:00+02:00
+url: /security/CVE-2026-71569.html
+draft: false
+type: security-advisory
+cve: CVE-2026-71569
+severity: MEDIUM
+summary: "Camel-A2A: Push notification webhook guard accepts IPv6 unique local
addresses reached through a host name, enabling blind server-side request
forgery"
+description: "WebhookUrlValidator classified a push notification webhook host
in two places that did not agree. A host written as an IP literal was matched
against a list of string prefixes that named the IPv6 unique local range
fc00::/7, while a host reached through a name was resolved and the resulting
address classified with the InetAddress predicates isLoopbackAddress,
isAnyLocalAddress, isLinkLocalAddress and isSiteLocalAddress. Those predicates
do not cover the same ground as the p [...]
+mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes
the issue. If users are on the 4.22.x releases stream, then they are suggested
to upgrade to 4.22.2. The 4.21.x release line reached end of life before this
issue was resolved and will not receive a fix, so deployments on it must move
to a supported release. Both the literal and the resolved path now classify the
address from its raw bytes with one shared classifier, which recognises
fc00::/7 and the shared addr [...]
+credit: "This issue was discovered by 2122295973 at qq dot com and reported
through the ASF Security Team"
+affected: "From 4.21.0 before 4.22.2."
+fixed: 4.22.2 and 4.23.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24371 refers to
the commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/25406
(commit 54041cce545322f7ff1bb362ecc02999b3d96ba0), and backported to
camel-4.22.x in https://github.com/apache/camel/pull/26583 (commit
c4a5c5fc968763474d0c6b0f8d840cee68c09142).
+
+Both paths now go through InetAddress.getByName, which parses a bracketed IPv6
literal without touching DNS, and classify the resulting address from its raw
bytes, so a host is judged by the address it denotes rather than by how it was
spelled. The string pre-check is gone, so names such as fcm.googleapis.com are
resolved and classified like any other name. NAT64 and 6to4 addresses carrying
a globally routable IPv4 address remain allowed, so an IPv6-only deployment can
still reach public [...]
+
+The camel-a2a component was introduced in 4.21.0 and is marked Preview, so the
affected range starts at that release; the 4.18.x and 4.14.x lines never
carried the component.
+
+This issue is distinct from the DNS pinning added in 4.22.0 by
https://issues.apache.org/jira/browse/CAMEL-23876, which makes the dispatcher
connect to the address the guard validated instead of resolving the host name a
second time. Pinning works as intended; the gap described here is in how that
address was classified, and it affects releases with and without pinning alike.
The issue is classified as CWE-918 (Server-Side Request Forgery).
diff --git a/content/security/CVE-2026-71569.txt.asc
b/content/security/CVE-2026-71569.txt.asc
new file mode 100644
index 00000000..c840ffb8
--- /dev/null
+++ b/content/security/CVE-2026-71569.txt.asc
@@ -0,0 +1,39 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-71569"
+date: 2026-10-23T10:00:00+02:00
+url: /security/CVE-2026-71569.html
+draft: false
+type: security-advisory
+cve: CVE-2026-71569
+severity: MEDIUM
+summary: "Camel-A2A: Push notification webhook guard accepts IPv6 unique local
addresses reached through a host name, enabling blind server-side request
forgery"
+description: "WebhookUrlValidator classified a push notification webhook host
in two places that did not agree. A host written as an IP literal was matched
against a list of string prefixes that named the IPv6 unique local range
fc00::/7, while a host reached through a name was resolved and the resulting
address classified with the InetAddress predicates isLoopbackAddress,
isAnyLocalAddress, isLinkLocalAddress and isSiteLocalAddress. Those predicates
do not cover the same ground as the p [...]
+mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes
the issue. If users are on the 4.22.x releases stream, then they are suggested
to upgrade to 4.22.2. The 4.21.x release line reached end of life before this
issue was resolved and will not receive a fix, so deployments on it must move
to a supported release. Both the literal and the resolved path now classify the
address from its raw bytes with one shared classifier, which recognises
fc00::/7 and the shared addr [...]
+credit: "This issue was discovered by 2122295973 at qq dot com and reported
through the ASF Security Team"
+affected: "From 4.21.0 before 4.22.2."
+fixed: 4.22.2 and 4.23.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24371 refers to
the commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/25406
(commit 54041cce545322f7ff1bb362ecc02999b3d96ba0), and backported to
camel-4.22.x in https://github.com/apache/camel/pull/26583 (commit
c4a5c5fc968763474d0c6b0f8d840cee68c09142).
+
+Both paths now go through InetAddress.getByName, which parses a bracketed IPv6
literal without touching DNS, and classify the resulting address from its raw
bytes, so a host is judged by the address it denotes rather than by how it was
spelled. The string pre-check is gone, so names such as fcm.googleapis.com are
resolved and classified like any other name. NAT64 and 6to4 addresses carrying
a globally routable IPv4 address remain allowed, so an IPv6-only deployment can
still reach public [...]
+
+The camel-a2a component was introduced in 4.21.0 and is marked Preview, so the
affected range starts at that release; the 4.18.x and 4.14.x lines never
carried the component.
+
+This issue is distinct from the DNS pinning added in 4.22.0 by
https://issues.apache.org/jira/browse/CAMEL-23876, which makes the dispatcher
connect to the address the guard validated instead of resolving the host name a
second time. Pinning works as intended; the gap described here is in how that
address was classified, and it affects releases with and without pinning alike.
The issue is classified as CWE-918 (Server-Side Request Forgery).
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrbKFoACgkQ406fOAL/
+QQCk6Qf+NuzbZafvPzB+9eCRDfIJqDyHlpgq64+ncW+Zw36WUJQLrnx/oqoztPgV
+Tagzyo+23xB5Wj50IV9NLiY8k4Fnr+C+jBZcYSnQq53bugXey6YFJlmvfxKVGrwu
+2ujEMCD7LsVS+Whof22VRys3uwOgvZR4H80nTM026r6r/SLonlQGwzTuktloWsZ4
+HD2ZqJdR7fMEjw8sa3vOCBQw//S4AeabCFtqi7QWHOsCtXwht5DGEm5NSUMTHxsU
+3OPwW36UNXAY/RPw9XcnX7rpJFDc3uKYY01PZJTfUNDKRU0dqahoNrcZ5Q5lBXT4
+pxj46KB5ldlhAPdeuQ7/vPk1K8tkIw==
+=dTfF
+-----END PGP SIGNATURE-----
