MavenPackage

org.apache.camel:camel-atmosphere-websocket

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-71300
Affects 4.0.0 to 4.14.8 (4.14.9 is outside it); 4.15.0 to 4.18.3 (4.18.4 is outside it); 4.19.0 to 4.21.0 (4.22.0 is outside it)
CVE-2026-55993
Affects 4.0.0 to 4.14.7 (4.14.8 is outside it); 4.15.0 to 4.18.2 (4.18.3 is outside it); 4.19.0 to 4.20.0 (4.21.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-71300Critical 9.8
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
Affected: from 4.0.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0; from 4.0.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0.
Fixed in 4.14.9 (released Aug 9, 2026, 15 days before disclosure), 4.18.4 (released Aug 10, 2026, 14 days before disclosure) and 4.22.0 (released Aug 7, 2026, 17 days before disclosure).
The latest release, 4.23.0, is not affected.
CVE-2026-55993High 7.5
Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a…
Affected: from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0; from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0.
Fixed in 4.14.8 (released Jun 28, 2026, 8 days before disclosure), 4.18.3 (released Jun 28, 2026, 8 days before disclosure) and 4.21.0 (released Jun 27, 2026, 9 days before disclosure).
The latest release, 4.23.0, is not affected.