Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Camel - CVE-2026-63621

 

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Camel - CVE-2026-63621

Published: August 25, 2026


Vulnerability identifier: #VU145145
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63621
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject internal headers to trigger server-side request forgery, path traversal, or message-dispatch redirection.

The vulnerability exists due to improper input validation and improper neutralization of special elements in output used by a downstream component in the Camel Knative consumer when processing structured-mode CloudEvent requests. A remote attacker can send a specially crafted CloudEvent request with extension fields that are copied into Exchange headers to inject internal headers to trigger server-side request forgery, path traversal, or message-dispatch redirection.

Exploitation requires a route that forwards messages from a Knative consumer to a header-driven component such as camel-http or camel-file. Only structured content mode requests with Content-Type application/cloudevents+json are affected.


Affected software

Apache Camel

How to mitigate CVE-2026-63621

Install security update from vendor's website.

Apache Camel - addressed in versions 4.14.9, 4.18.4, 4.22.0

External References

Related Security Bulletins