CVE-2026-77310 is a Server-Side Request Forgery (SSRF) vulnerability in the jackson-databind library's deserialization of java.net.InetAddress. Unlike the previously fixed InetSocketAddress deserialization which avoids DNS resolution, the InetAddress deserialization still performs eager DNS lookups on attacker-controlled input. This can lead to DNS-based SSRF allowing out-of-band interaction or internal host enumeration via DNS queries during JSON deserialization.
CVE-2026-78329 is a critical improper input validation vulnerability in the Apache Camel Undertow component. The issue arises because the default headerFilterStrategy used by UndertowEndpoint overwrites the intended UndertowHeaderFilterStrategy, causing undertow-specific header filtering to be bypassed. This allows legacy websocket. Exchange-header prefixed headers to be mapped onto the Exchange without proper filtering, potentially enabling an undertow WebSocket producer to dispatch messages incorrectly. The vulnerability affects Apache Camel versions from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective LTS patch releases mitigates the issue. For deployments unable to upgrade immediately, explicit configuration of the headerFilterStrategy and manual header stripping are recommended as mitigations.
CVE-2026-71300 is an improper input validation vulnerability in the Apache Camel Atmosphere Websocket component. It allows an external sender to manipulate WebSocket message dispatch headers, potentially causing messages to be delivered to unintended connected clients. This issue affects multiple Apache Camel versions from 4.0.0 up to but not including 4.14.9, 4.15.0 up to but not including 4.18.4, and 4.19.0 up to but not including 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should strip the relevant dispatch headers at the trust boundary before the producer. The fix involves renaming header string values into the Camel namespace, which may cause breaking changes for routes that set them by literal string.
CVE-2026-63621 is an improper input validation vulnerability in the Apache Camel Knative component. It allows unauthenticated attackers to inject internal Camel headers via structured-mode CloudEvent requests, potentially enabling server-side request forgery, path traversal, or message dispatch redirection. This issue affects multiple Apache Camel versions and is fixed in later releases.
CVE-2026-66908 is an improper authentication vulnerability in the Apache Camel Platform HTTP Main component affecting versions from 4.8.0 up to but not including 4.22.0. The issue arises because the JWT authentication configuration does not enforce validation of the issuer (iss) and audience (aud) claims unless explicitly configured, allowing acceptance of any unexpired token signed by a trusted key. This can lead to acceptance of tokens intended for other services or audiences within the same trust domain. The vulnerability is fixed in version 4.22.0, which requires explicit configuration of issuer and audience claims or an explicit override to allow missing claims. Users on maintenance branches 4.14.x and 4.18.x should upgrade to versions 4.14.9 or 4.18.4 and configure these claims accordingly.
CVE-2026-66907 is a relative path traversal vulnerability in the Apache Camel Google Storage component. It affects versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability arises because the component downloads Google Cloud Storage objects to the local filesystem without properly normalizing or restricting the destination path, allowing crafted object names containing parent-directory segments to escape the intended download directory. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process. A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0.
CVE-2026-66906 is a critical relative path traversal vulnerability in the Apache Camel Azure Storage Blob component. It allows an attacker who can influence blob names in an Azure Storage container to cause Camel to write files outside the intended directory on the local filesystem. This occurs because the component does not normalize or restrict blob names containing parent-directory segments when downloading blobs to files. The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Fixed versions are available, and users are advised to upgrade to these fixed releases. Alternative mitigations include filtering blob names with regex or avoiding the vulnerable operation on untrusted containers.
A relative path traversal vulnerability exists in the Apache Camel Azure-Storage Datalake component's downloadToFile operation. This flaw allows an attacker who can influence file names in the consumed Azure Data Lake filesystem to cause Camel to write files outside the intended directory, potentially overwriting arbitrary files with the privileges of the Camel process. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective patch releases 4.14.9 or 4.18.4 mitigates this vulnerability.
Apache Camel contains an improper input validation vulnerability in its camel-mail component's MimeMultipart data format when configured with headersInline set to true. This flaw allows untrusted MIME headers to be copied as Camel message headers without filtering, potentially enabling an attacker to inject headers in the Camel-internal namespace. Such injected headers can alter the behavior of downstream route steps, depending on the route configuration. The issue affects versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should keep headersInline disabled or strip Camel-internal headers after unmarshalling.
An unauthenticated SQL injection vulnerability exists in the GeoTools PostGIS DataStore implementation's jsonArrayContains filter function. This affects GeoTools versions prior to patched releases 35.1, 34.5, and 33.6. The vulnerability allows arbitrary SQL expressions to be executed in the database when using PostGIS 12 or greater with String or JSON fields. The vulnerability has a critical severity with a CVSS score of 9.8. No direct mitigation is available other than applying the official patches or limiting database connection rights.
A critical vulnerability (CVE-2026-18963) exists in the reset-credentials flow of the keycloak-services component in Red Hat build of Keycloak. This flaw allows an unauthenticated attacker to bypass the required email verification step and reset the password of any user, enabling full account takeover by setting new credentials directly. The issue affects multiple versions of Keycloak prior to fixed releases. Red Hat has released patches to address this vulnerability.
Netty's CorsHandler component overwrites existing Vary headers with a fixed value, causing cache poisoning and potential information disclosure. This affects Netty-based web applications that rely on Vary headers like Authorization or Cookie to control caching behavior behind proxies or CDNs. Attackers may retrieve cached sensitive data belonging to other users. The vulnerability is fixed in versions 4.2.17.Final and 4.1.137.Final.
Netty's SctpMessageCompletionHandler does not enforce a maximum size limit on buffered SCTP message fragments, allowing an unauthenticated attacker to cause memory exhaustion by sending large SCTP fragments. This can lead to an OutOfMemoryError and disrupt service availability. The vulnerability affects versions of io.netty:netty-transport-sctp prior to 4.2.17.Final and 4.1.137.Final.
OpenAM Community Edition through version 16.0.6 has an insecure default configuration where the iPlanetDirectoryPro SSO cookie is set with HttpOnly=false. This cookie is also used as a CSRF token in OAuth/OIDC flows. The vulnerability allows an attacker to steal the full SSO session of an authenticated console user by leveraging same-origin XSS vulnerabilities. The issue is patched in version 16.1.1.
Apache Ranger versions 0.6.0 through 2.8.0 contain a critical command injection vulnerability (CVE-2026-28672) due to improper neutralization of special elements in commands. This flaw allows unauthenticated remote attackers to execute arbitrary commands, potentially leading to full system compromise.
Bouncy Castle for Java FIPS versions prior to 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series), and 2.1.3 (2.1.X series) improperly zeroise sensitive key material using Object.finalize. This finalization approach delays clearing key material, potentially leaving sensitive data in memory longer than intended and causing memory issues under load. The issue affects AES, DESede engines, certain DRBGs, and key parameter classes. Later versions replace finalization with java.lang.ref.Cleaner for timely zeroisation on Java 9 and above. Bouncy Castle for Java (bcprov) and LTS versions are not affected.
Bouncy Castle for Java FIPS (bc-fips) versions 2.1.0 through 2.1.2 contain a vulnerability in the native entropy source on Intel platforms. The issue causes unbounded retry loops when CPU entropy instructions RDSEED and RDRAND fail, leading to indefinite hangs in the JNI seeding routine. This denial of service occurs because the retry loop spins without interruption or timeout if the entropy source fails persistently. The vulnerability was fixed in version 2.1.3 by bounding retry attempts, adding pauses, and throwing exceptions on exhaustion.
A vulnerability in Netty's RedisArrayAggregator component causes retained partial aggregate state to persist after a max-elements limit exception. This occurs because the handler fails to clear retained state when the maxElements limit is exceeded, unlike the maxNestedArrayDepth limit which triggers cleanup. An unauthenticated peer can exploit this by sending crafted RESP arrays, causing retained buffers to persist until channel closure or later message completion. This can lead to resource retention and potential denial of service. The issue affects io.netty:netty-codec-redis versions before 4.1.136.Final and from 4.2.0-Final up to but excluding 4.2.16.Final. A fix is available in versions 4.1.136.Final and 4.2.16.Final.
A cross-site scripting (XSS) vulnerability exists in jsoup, a Java HTML parsing library, in versions from 1.14.3 up to but not including 1.23.1. The issue arises when the parser incorrectly handles malformed tag names ending with control characters, causing misparsing that can lead to active markup being emitted instead of inert text when using custom Safelists that allow certain raw-text elements. The built-in Safelists are not affected. This vulnerability has a medium severity score and is fixed in version 1.23.1.
Apache Qpid Proton-J versions prior to 0.35.0 contain a vulnerability where unbounded type nesting can cause a StackOverflowError before authentication. This flaw can be exploited by an attacker to cause a denial of service. The issue is fixed in version 0.35.0.