Skip to content

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 

Repository files navigation

Security Research

Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 42 CVEs across 13 projects, 2023 to 2026.

Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and names the release that fixed it.

Across 23 distinct CWEs, two classes dominate: deserialization of untrusted data (7) and server-side request forgery (7).

Across the Apache ecosystem: 14 CVEs, 12 projects

CVE Component Class Fixed in PoC
CVE-2023-41313 Doris CWE-208 Observable Timing Discrepancy 1.2.8 -
CVE-2023-41834 Flink Stateful Functions CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 3.2.0 -
CVE-2023-43123 Storm CWE-200 Exposure of Sensitive Information to an Unauthorized Actor 2.6.0 -
CVE-2024-23454 Hadoop CWE-378 Creation of Temporary File With Insecure Permissions 3.4.0 -
CVE-2024-23953 Hive CWE-208 Observable Timing Discrepancy 4.0.0 -
CVE-2024-29869 Hive CWE-732 Incorrect Permission Assignment for Critical Resource 4.0.1 -
CVE-2026-34476 SkyWalking MCP CWE-918 Server-Side Request Forgery not published -
CVE-2026-40005 IoTDB CWE-22 Improper Limitation of a Pathname to a Restricted Directory 2.0.10 -
CVE-2026-40008 IoTDB CWE-470 Use of Externally-Controlled Input to Select Classes or Code 2.0.10 -
CVE-2026-40564 Flink Kubernetes Operator CWE-918 Server-Side Request Forgery 1.15.0 reproducer
CVE-2026-41041 Gravitino CWE-177 Improper Handling of URL Encoding 1.2.1 -
CVE-2026-44616 Zeppelin CWE-90 Improper Neutralization of Special Elements used in an LDAP Query 0.12.1 -
CVE-2026-49361 Fluss (incubating) CWE-400 Uncontrolled Resource Consumption not published -
CVE-2026-64640 Polaris CWE-863 Incorrect Authorization 1.6.0 -

Apache Camel: 28 CVEs

Camel is the project I maintain, so it gets the most scrutiny. The dominant pattern is unfiltered inbound headers reaching a producer's control plane, plus a long tail of unsafe deserialization in registry and migration paths.

CVE Component Class Fixed in PoC
CVE-2024-23114 Camel CWE-502 Deserialization of Untrusted Data 3.21.4, 3.22.1, 4.0.4, 4.4.0 -
CVE-2026-23552 Camel CWE-346 Origin Validation Error 4.18.0 reproducer
CVE-2026-25747 Camel LevelDB CWE-502 Deserialization of Untrusted Data 4.10.9, 4.14.5, 4.18.0 reproducer
CVE-2026-27172 Camel CWE-502 Deserialization of Untrusted Data 4.14.6, 4.18.1 reproducer
CVE-2026-40047 Camel CWE-88 Improper Neutralization of Argument Delimiters in a Command 4.18.3 reproducer
CVE-2026-40048 Camel PQC CWE-502 Deserialization of Untrusted Data 4.18.2, 4.20.0 reproducer
CVE-2026-43866 Camel CWE-502 Deserialization of Untrusted Data 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-43867 Camel CWE-502 Deserialization of Untrusted Data 4.18.3, 4.21.0 reproducer
CVE-2026-46455 Camel CWE-613 Insufficient Session Expiration 4.18.3, 4.21.0 reproducer
CVE-2026-46585 Camel Lucene CWE-639 Authorization Bypass Through User-Controlled Key 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-46590 Camel CWE-502 Deserialization of Untrusted Data 4.18.3, 4.21.0 reproducer
CVE-2026-46591 Camel CWE-943 Improper Neutralization of Special Elements in Data Query Logic 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-46592 Camel CWE-441 Unintended Proxy or Intermediary 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-46726 Camel Vertx Websocket CWE-918 Server-Side Request Forgery 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-48203 Camel CWE-918 Server-Side Request Forgery 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-48204 Camel CWE-284 Improper Access Control 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-48205 Camel DNS CWE-918 Server-Side Request Forgery 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-48206 Camel JIRA CWE-639 Authorization Bypass Through User-Controlled Key 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-49086 Camel Dapr CWE-441 Unintended Proxy or Intermediary 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-49097 Camel CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-49098 Camel CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-49099 Camel Salesforce CWE-639 Authorization Bypass Through User-Controlled Key 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-49365 Camel CWE-209 Generation of Error Message Containing Sensitive Information 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-53913 Camel Keycloak CWE-636 Not Failing Securely 4.18.3, 4.21.0 reproducer
CVE-2026-55993 Camel Atmosphere Websocket CWE-918 Server-Side Request Forgery 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-55994 Camel Iggy CWE-918 Server-Side Request Forgery 4.18.3, 4.21.0 reproducer
CVE-2026-56139 Camel Undertow CWE-209 Generation of Error Message Containing Sensitive Information 4.14.8, 4.18.3, 4.21.0 reproducer
CVE-2026-56140 Camel AWS2 SNS CWE-20 Improper Input Validation 4.14.8, 4.18.3, 4.21.0 -

Reproducers for issues found by others: 20

As a Camel maintainer I also build reproducers for reports that come in from outside, to confirm the issue and validate the fix. These are not my findings. Credit belongs to the reporters named below.

CVE Component Class Fixed in Reported by PoC
CVE-2024-22369 Camel CWE-502 Deserialization of Untrusted Data 3.21.4, 3.22.1, 4.0.4, 4.4.0 Ziyang Chen from HuaWei Open Source Management Center, Pingtao Wei from HuaWei Open Source Management Center (finder) and Haoran Zhi from HuaWei Open Source Management Center reproducer
CVE-2026-33453 Camel CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes 4.14.5, 4.18.1 Hyunwoo Kim (@v4bel) reproducer
CVE-2026-33454 Camel CWE-502 Deserialization of Untrusted Data 4.14.6, 4.18.1 Hyunwoo Kim (@v4bel) reproducer
CVE-2026-40022 Camel Platform HTTP Main CWE-288 Authentication Bypass Using an Alternate Path or Channel 4.14.6, 4.18.2 Jihang Yu reproducer
CVE-2026-40453 Camel JMS CWE-178 Improper Handling of Case Sensitivity 4.14.6, 4.18.2, 4.20.0 Saroj Khadka reproducer
CVE-2026-40473 Camel Mina CWE-502 Deserialization of Untrusted Data 4.14.6, 4.18.2, 4.20.0 Venkatraman Kumar from Securin reproducer
CVE-2026-40858 Camel CWE-502 Deserialization of Untrusted Data 4.14.7, 4.18.2, 4.20.0 Feng Ning from Innora Pte. Ltd. reproducer
CVE-2026-40859 Camel CWE-502 Deserialization of Untrusted Data 4.14.8, 4.18.3, 4.20.0 Venkatraman Kumar from Securin reproducer
CVE-2026-40860 Camel CWE-502 Deserialization of Untrusted Data 4.14.7, 4.18.2, 4.20.0 Venkatraman Kumar from Securin reproducer
CVE-2026-42527 Camel CWE-502 Deserialization of Untrusted Data 4.14.8, 4.18.3, 4.21.0 Venkatraman Kumar from Securin and Yu Bao from Paypal reproducer
CVE-2026-43865 Camel CWE-502 Deserialization of Untrusted Data 4.14.8, 4.18.3, 4.21.0 gaorenyusi reproducer
CVE-2026-46453 Camel CWE-639 Authorization Bypass Through User-Controlled Key 4.14.8, 4.18.3, 4.21.0 Yu Bao from PayPal reproducer
CVE-2026-46454 Camel CWE-20 Improper Input Validation 4.14.8, 4.18.3, 4.21.0 Yu Bao from PayPal reproducer
CVE-2026-46456 Camel CWE-20 Improper Input Validation 4.14.8, 4.18.3, 4.21.0 Yu Bao from PayPal reproducer
CVE-2026-46457 Camel CWE-20 Improper Input Validation 4.14.8, 4.18.3, 4.21.0 Yu Bao from PayPal reproducer
CVE-2026-46584 Camel Mail CWE-200 Exposure of Sensitive Information to an Unauthorized Actor 4.14.8, 4.18.3, r Yu Bao from PayPal reproducer
CVE-2026-46587 Camel CWE-20 Improper Input Validation 4.14.7, 4.18.2, 4.20.0 Yu Bao from PayPal reproducer
CVE-2026-46588 Camel CWE-20 Improper Input Validation 4.14.7, 4.18.2, 4.20.0 Yu Bao from PayPal reproducer
CVE-2026-47323 Camel CWE-178 Improper Handling of Case Sensitivity 4.14.6, 4.18.2 Quac Tran reproducer
CVE-2026-49042 Camel CWE-20 Improper Input Validation 4.18.2, 4.20.0 Yu Bao from PayPal reproducer

Findings are reported privately to the relevant ASF security team and published only after a fix ships. Reproducers target the vulnerable version and are intended for defenders validating their own exposure.

About

Vulnerabilities I've reported across the Apache ecosystem — 42 CVEs across 13 projects

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors