Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-43866Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolderMaven · org.apache.camel:camel-activemq, org.apache.camel:camel-activemq6 +4 · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-43867Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilterMaven · org.apache.camel:camel-pqc · fixed in 4.18.3, 4.21.0
- CVE-2026-56140Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling componentsMaven · org.apache.camel:camel-aws2-sns · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-56139Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clientsMaven · org.apache.camel:camel-undertow · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-55994Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviourMaven · org.apache.camel:camel-iggy · fixed in 4.18.3, 4.21.0
- CVE-2026-55993Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviourMaven · org.apache.camel:camel-atmosphere-websocket · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-53913Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is acceptedMaven · org.apache.camel:camel-keycloak · fixed in 4.18.3, 4.21.0
- CVE-2026-49365Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clientsMaven · org.apache.camel:camel-netty-http · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-49099Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviourMaven · org.apache.camel:camel-salesforce · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-49098Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topicMaven · org.apache.camel:camel-kafka · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-49097Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or usersMaven · org.apache.camel:camel-irc · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-49086Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to influence internal behaviourMaven · org.apache.camel:camel-dapr · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-48206Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentialsMaven · org.apache.camel:camel-jira · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-48205Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviourMaven · org.apache.camel:camel-dns · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-48204Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configurationMaven · org.apache.camel:camel-mongodb-gridfs · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-48203Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fieldsMaven · org.apache.camel:camel-solr · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46726Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headersMaven · org.apache.camel:camel-vertx-websocket · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46592Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operationMaven · org.apache.camel:camel-cxf-rest, org.apache.camel:camel-cxf-soap · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46591Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)Maven · org.apache.camel:camel-neo4j · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46590Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)Maven · org.apache.camel:camel-pqc · fixed in 4.18.3, 4.21.0
- CVE-2026-46585Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search queryMaven · org.apache.camel:camel-lucene · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46584Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parametersMaven · org.apache.camel:camel-mail · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46457Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headersMaven · org.apache.camel:camel-nats · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46456Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headersMaven · org.apache.camel:camel-aws2-sqs · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46455Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be acceptedMaven · org.apache.camel:camel-keycloak · fixed in 4.18.3, 4.21.0
- CVE-2026-46454Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headersMaven · org.apache.camel:camel-cometd · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46453Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operationMaven · org.apache.camel:camel-elasticsearch-rest-client · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-43865Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionMaven · org.apache.camel:camel-hazelcast · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-42527Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosureMaven · org.apache.camel:camel-amqp, org.apache.camel:camel-cassandraql +10 · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-40859Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabledMaven · org.apache.camel:camel-netty-http, org.apache.camel:camel-vertx-http · fixed in 4.14.8, 4.18.3, 4.20.0