This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 1d32dd9a675d1be92d94a18c6e7f93d1311dae18 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 12 15:11:00 2026 +0200 Added CVE-2026-83531 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-83531.md | 23 ++++++++++++++++++++ content/security/CVE-2026-83531.txt.asc | 37 +++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/content/security/CVE-2026-83531.md b/content/security/CVE-2026-83531.md new file mode 100644 index 00000000..17f58f4a --- /dev/null +++ b/content/security/CVE-2026-83531.md @@ -0,0 +1,23 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-83531" +date: 2026-10-12T10:00:00+02:00 +url: /security/CVE-2026-83531.html +draft: false +type: security-advisory +cve: CVE-2026-83531 +severity: HIGH +summary: "Camel-Dynamic-Router: The dynamic-router-control endpoint compiled the subscription predicate from an expression and an expression language supplied by the control message, allowing an actor who can send messages to a route that forwards them to the control endpoint to execute code in the Camel process" +description: "The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDyn [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that ca [...] +credit: "This issue was discovered by Leon Zlobecki" +affected: "From 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24576 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25992 (commit 1d5d3e983c3a3fb64b6bfe238d614726191ee977), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26018 (commit e09d945d9458d57d580fa88029ba1cd62d0837cc) and to camel-4.18.x in https://github.com/apache/camel/pull/26019 (commit a1132971f3d64fd4d1dc748c3bfa87c49130ac9b). A follow-up documentation change, https://github.com/apache/camel/pull/26020 (commit b74fcd1ae8d17a9fd74322b02127c9bd4b41fae [...] + +A new allowPredicateFromMessage option on the dynamic-router-control endpoint, defaulting to false, now decides whether the subscription predicate and its expression language may be taken from a control message. When it is false, a subscribe or update request whose DynamicRouterControlMessage body or headers carry a predicate expression or an expression language is rejected with an IllegalArgumentException, and the predicate and expressionLanguage configured on the endpoint are used inst [...] + +This is a change of default behaviour for applications whose control messages supply their own predicate expression: they must set allowPredicateFromMessage=true on the control endpoint, which should only be done when every sender of control messages is trusted. The change is documented in the upgrade guides for each affected release line. The issue is classified as CWE-94 (Improper Control of Generation of Code ('Code Injection')) and CWE-917 (Improper Neutralization of Special Elements [...] diff --git a/content/security/CVE-2026-83531.txt.asc b/content/security/CVE-2026-83531.txt.asc new file mode 100644 index 00000000..70560f56 --- /dev/null +++ b/content/security/CVE-2026-83531.txt.asc @@ -0,0 +1,37 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-83531" +date: 2026-10-12T10:00:00+02:00 +url: /security/CVE-2026-83531.html +draft: false +type: security-advisory +cve: CVE-2026-83531 +severity: HIGH +summary: "Camel-Dynamic-Router: The dynamic-router-control endpoint compiled the subscription predicate from an expression and an expression language supplied by the control message, allowing an actor who can send messages to a route that forwards them to the control endpoint to execute code in the Camel process" +description: "The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDyn [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that ca [...] +credit: "This issue was discovered by Leon Zlobecki" +affected: "From 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24576 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25992 (commit 1d5d3e983c3a3fb64b6bfe238d614726191ee977), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26018 (commit e09d945d9458d57d580fa88029ba1cd62d0837cc) and to camel-4.18.x in https://github.com/apache/camel/pull/26019 (commit a1132971f3d64fd4d1dc748c3bfa87c49130ac9b). A follow-up documentation change, https://github.com/apache/camel/pull/26020 (commit b74fcd1ae8d17a9fd74322b02127c9bd4b41fae [...] + +A new allowPredicateFromMessage option on the dynamic-router-control endpoint, defaulting to false, now decides whether the subscription predicate and its expression language may be taken from a control message. When it is false, a subscribe or update request whose DynamicRouterControlMessage body or headers carry a predicate expression or an expression language is rejected with an IllegalArgumentException, and the predicate and expressionLanguage configured on the endpoint are used inst [...] + +This is a change of default behaviour for applications whose control messages supply their own predicate expression: they must set allowPredicateFromMessage=true on the control endpoint, which should only be done when every sender of control messages is trusted. The change is documented in the upgrade guides for each affected release line. The issue is classified as CWE-94 (Improper Control of Generation of Code ('Code Injection')) and CWE-917 (Improper Neutralization of Special Elements [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrM3FIACgkQ406fOAL/ +QQBgsgf7BXuywNlz6AZK5OY5/B5I/Pj6IzwlK6ae5dGw5yhd3/hEl6rfCd/x7fZb +IzlcOUEQ0Mmpt8+CJawfKbp0BfvBu3vCNs6uEvBSnboXxVxeKLd6Qkl5MjM6zaWz +XCCs0wt1NjMaUTeL8wdDeRknHREDv0zCvOPV1xhHHP8s7fSTh9W8t4fS1LrZ+2Xo +QCR6u8xBkLJR58wf7LOtKJ3lizcCpNIz4FI2E+0gennr3ifC/ILwyVZahSZd9sKY +OhY72ecddgxWuRVp1cp52NuJIQ9xukYwcrT6se5FmggH/VkmN1B6FUbKXPwhb+ii +1uE1jqd8aze22ZWGmWDYG20bd2TtAA== +=YUMY +-----END PGP SIGNATURE-----
