This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit c12a8a282c31277c8a1eb270a1ac2a948e81c5d5 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Aug 24 11:59:08 2026 +0200 Added CVE-2026-78329 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-78329.md | 21 ++++++++++++++++++++ content/security/CVE-2026-78329.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-78329.md b/content/security/CVE-2026-78329.md new file mode 100644 index 00000000..5649b0eb --- /dev/null +++ b/content/security/CVE-2026-78329.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-78329" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-78329.html +draft: false +type: security-advisory +cve: CVE-2026-78329 +severity: MEDIUM +summary: "Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes" +description: "UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed that instance into the UndertowHttpBinding it creates lazily, overwriting the UndertowHeaderFilterStrategy that DefaultUndertowHttpBinding installs in its own constructor. Unless a deployment supplied a custom binding or an explicit headerFilterStrategy, the undertow-specific filtering therefore never executed on endpoint-configured routes: the strategy object was const [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, configure the strategy explicitly rather than relying on the default, for example by binding an UndertowHeaderFilterStrategy in the registry and referencing it on the endp [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation and Barak Srour from Apiiro" +affected: "From 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0." +fixed: 4.14.9, 4.18.4 and 4.22.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24360 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25367 (commit 859e93b4b37fe41918c50812cb1fedb20ca6b8e1) and backported to camel-4.18.x in https://github.com/apache/camel/pull/25379 (commit 1574902d79cc5d36a2e618f7470bf0cba005d5e5) and to camel-4.14.x in https://github.com/apache/camel/pull/25381 (commit 0484842201ed53fb52f3223f9b698868644f5b6f). It restores UndertowHeaderFilterStrategy as the endpoint default, so the strategy the binding installs is no longer replaced [...] + +The endpoint default was changed to the base strategy by a refactoring that deprecated the component-specific HTTP header filter strategies, first released in 4.11.0; before that release the endpoint used the undertow strategy correctly, which is why the affected range starts there and not at the introduction of the component. The issue is classified as CWE-20 (Improper Input Validation), reflecting the effect of the unapplied filter on inbound headers rather than the wiring defect itself. diff --git a/content/security/CVE-2026-78329.txt.asc b/content/security/CVE-2026-78329.txt.asc new file mode 100644 index 00000000..5fae6029 --- /dev/null +++ b/content/security/CVE-2026-78329.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-78329" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-78329.html +draft: false +type: security-advisory +cve: CVE-2026-78329 +severity: MEDIUM +summary: "Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes" +description: "UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed that instance into the UndertowHttpBinding it creates lazily, overwriting the UndertowHeaderFilterStrategy that DefaultUndertowHttpBinding installs in its own constructor. Unless a deployment supplied a custom binding or an explicit headerFilterStrategy, the undertow-specific filtering therefore never executed on endpoint-configured routes: the strategy object was const [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, configure the strategy explicitly rather than relying on the default, for example by binding an UndertowHeaderFilterStrategy in the registry and referencing it on the endp [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation and Barak Srour from Apiiro" +affected: "From 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0." +fixed: 4.14.9, 4.18.4 and 4.22.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24360 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25367 (commit 859e93b4b37fe41918c50812cb1fedb20ca6b8e1) and backported to camel-4.18.x in https://github.com/apache/camel/pull/25379 (commit 1574902d79cc5d36a2e618f7470bf0cba005d5e5) and to camel-4.14.x in https://github.com/apache/camel/pull/25381 (commit 0484842201ed53fb52f3223f9b698868644f5b6f). It restores UndertowHeaderFilterStrategy as the endpoint default, so the strategy the binding installs is no longer replaced [...] + +The endpoint default was changed to the base strategy by a refactoring that deprecated the component-specific HTTP header filter strategies, first released in 4.11.0; before that release the endpoint used the undertow strategy correctly, which is why the affected range starts there and not at the introduction of the component. The issue is classified as CWE-20 (Improper Input Validation), reflecting the effect of the unapplied filter on inbound headers rather than the wiring defect itself. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqMFdgACgkQ406fOAL/ +QQAjkwf7B23o/H/t38JjnE3DTefEv2cWq7+sXzCxVFIoCsa1nFlNgIX8PbWPxA50 +cEczfHx+ZMbU/eMI2oUjmnElNh+iPSATijdKgooHuWxFqD7RwjWIV7pzR7PwogLs +epysZcOtU+HeimfO1IYgEeZhQrTtjkAfMVgk4T+orDgQXuTUAYeNGHZSDXC6hJR3 +nuD2S08qR28S3gJmI4LRI2Tj4xucBDi88+2+UMRzP58haj7yarCf57PUryUuwYtp +wykMaJyIczSgsUxf8xjc3icVLI9dudHdZ8VNciYwkC/o94S3I/gA4ZyXSa4nFNse +NT/Z615K9kdHHoM2qzKQ5e0spWOjnA== +=RF3L +-----END PGP SIGNATURE-----
