This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 2393bf4c5b32ce47e6ba7a8ce7a7fc1dfa865779 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:42 2026 +0200 Added CVE-2026-85254 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-85254.md | 21 ++++++++++++++++++++ content/security/CVE-2026-85254.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-85254.md b/content/security/CVE-2026-85254.md new file mode 100644 index 00000000..d22e6c34 --- /dev/null +++ b/content/security/CVE-2026-85254.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-85254" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85254.html +draft: false +type: security-advisory +cve: CVE-2026-85254 +severity: MEDIUM +summary: "Camel-Platform-HTTP: request-header echo suppression bypass - the check that stops a request header being echoed into the response compared header names case sensitively, so a differently cased name defeated it, and under HTTP/2 it never matched at all" +description: "The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by varying the case of the header name. HTTP/2 makes the problem unconditional rather than optional: the protocol requires header names to be lowercase on the wire, so the comparison never matched and the suppression was inert for every request on an HTTP/2 conn [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Request header names are now compared case insensitively, so the suppression holds regardless of casing and works under HTTP/2. For deployments that cannot upgrade immediately, strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24453 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25831 (commit 126c79bdf3f171184461f987c143b5a818df4d81), backported to camel-4.22.x in https://github.com/apache/camel/pull/25940 (commit 260989268cbc6d258b1fcba63770be8ebbec40cb) and to camel-4.18.x in https://github.com/apache/camel/pull/25942 (commit af1efbcccf5882b1ef0094db718972da3190e7e9). + +The issue is classified as CWE-178 Improper Handling of Case Sensitivity. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-85254.txt.asc b/content/security/CVE-2026-85254.txt.asc new file mode 100644 index 00000000..02900df8 --- /dev/null +++ b/content/security/CVE-2026-85254.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-85254" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85254.html +draft: false +type: security-advisory +cve: CVE-2026-85254 +severity: MEDIUM +summary: "Camel-Platform-HTTP: request-header echo suppression bypass - the check that stops a request header being echoed into the response compared header names case sensitively, so a differently cased name defeated it, and under HTTP/2 it never matched at all" +description: "The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by varying the case of the header name. HTTP/2 makes the problem unconditional rather than optional: the protocol requires header names to be lowercase on the wire, so the comparison never matched and the suppression was inert for every request on an HTTP/2 conn [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Request header names are now compared case insensitively, so the suppression holds regardless of casing and works under HTTP/2. For deployments that cannot upgrade immediately, strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24453 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25831 (commit 126c79bdf3f171184461f987c143b5a818df4d81), backported to camel-4.22.x in https://github.com/apache/camel/pull/25940 (commit 260989268cbc6d258b1fcba63770be8ebbec40cb) and to camel-4.18.x in https://github.com/apache/camel/pull/25942 (commit af1efbcccf5882b1ef0094db718972da3190e7e9). + +The issue is classified as CWE-178 Improper Handling of Case Sensitivity. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrYACgkQ406fOAL/ +QQCwuAf+NrIYHUFcNhMBFID6CdZDTt+srOI6HIkl9+mybfKYRCSCc8q6nqex9tsi +nx6RniyEDD1zFvGMp6d+AnycShB156yyKYqiodju+aOmTNKw+gZw66lyX7INmTAe +JY8PBFYqFcXn4Q+4UqsDMRlIdQnXyIiLBoB2TIo424+anr/QsOSDwLGuOKuaEdgR +JrQ+4cGB+uB2YUsZwhwy3xdALRRW140v5Xw24uV/afCytv04/o79MYuA+AxdIcQE ++xKMS5+YGiLvoGw3/rFnRv82iwcYQsvjNtuOEhFduU+g+6gbduYHfG7UJgWEjGaS +4R/UZpom0J8JROu43CY3k/lTG7yXmA== +=saz9 +-----END PGP SIGNATURE-----
