Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 42 CVEs across 13 projects, 2023 to 2026.
Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and names the release that fixed it.
Across 23 distinct CWEs, two classes dominate: deserialization of untrusted data (7) and server-side request forgery (7).
| CVE | Component | Class | Fixed in | PoC |
|---|---|---|---|---|
| CVE-2023-41313 | Doris | CWE-208 Observable Timing Discrepancy |
1.2.8 |
- |
| CVE-2023-41834 | Flink Stateful Functions | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component |
3.2.0 |
- |
| CVE-2023-43123 | Storm | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
2.6.0 |
- |
| CVE-2024-23454 | Hadoop | CWE-378 Creation of Temporary File With Insecure Permissions |
3.4.0 |
- |
| CVE-2024-23953 | Hive | CWE-208 Observable Timing Discrepancy |
4.0.0 |
- |
| CVE-2024-29869 | Hive | CWE-732 Incorrect Permission Assignment for Critical Resource |
4.0.1 |
- |
| CVE-2026-34476 | SkyWalking MCP | CWE-918 Server-Side Request Forgery |
not published | - |
| CVE-2026-40005 | IoTDB | CWE-22 Improper Limitation of a Pathname to a Restricted Directory |
2.0.10 |
- |
| CVE-2026-40008 | IoTDB | CWE-470 Use of Externally-Controlled Input to Select Classes or Code |
2.0.10 |
- |
| CVE-2026-40564 | Flink Kubernetes Operator | CWE-918 Server-Side Request Forgery |
1.15.0 |
reproducer |
| CVE-2026-41041 | Gravitino | CWE-177 Improper Handling of URL Encoding |
1.2.1 |
- |
| CVE-2026-44616 | Zeppelin | CWE-90 Improper Neutralization of Special Elements used in an LDAP Query |
0.12.1 |
- |
| CVE-2026-49361 | Fluss (incubating) | CWE-400 Uncontrolled Resource Consumption |
not published | - |
| CVE-2026-64640 | Polaris | CWE-863 Incorrect Authorization |
1.6.0 |
- |
Camel is the project I maintain, so it gets the most scrutiny. The dominant pattern is unfiltered inbound headers reaching a producer's control plane, plus a long tail of unsafe deserialization in registry and migration paths.
| CVE | Component | Class | Fixed in | PoC |
|---|---|---|---|---|
| CVE-2024-23114 | Camel | CWE-502 Deserialization of Untrusted Data |
3.21.4, 3.22.1, 4.0.4, 4.4.0 |
- |
| CVE-2026-23552 | Camel | CWE-346 Origin Validation Error |
4.18.0 |
reproducer |
| CVE-2026-25747 | Camel LevelDB | CWE-502 Deserialization of Untrusted Data |
4.10.9, 4.14.5, 4.18.0 |
reproducer |
| CVE-2026-27172 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.6, 4.18.1 |
reproducer |
| CVE-2026-40047 | Camel | CWE-88 Improper Neutralization of Argument Delimiters in a Command |
4.18.3 |
reproducer |
| CVE-2026-40048 | Camel PQC | CWE-502 Deserialization of Untrusted Data |
4.18.2, 4.20.0 |
reproducer |
| CVE-2026-43866 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-43867 | Camel | CWE-502 Deserialization of Untrusted Data |
4.18.3, 4.21.0 |
reproducer |
| CVE-2026-46455 | Camel | CWE-613 Insufficient Session Expiration |
4.18.3, 4.21.0 |
reproducer |
| CVE-2026-46585 | Camel Lucene | CWE-639 Authorization Bypass Through User-Controlled Key |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-46590 | Camel | CWE-502 Deserialization of Untrusted Data |
4.18.3, 4.21.0 |
reproducer |
| CVE-2026-46591 | Camel | CWE-943 Improper Neutralization of Special Elements in Data Query Logic |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-46592 | Camel | CWE-441 Unintended Proxy or Intermediary |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-46726 | Camel Vertx Websocket | CWE-918 Server-Side Request Forgery |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-48203 | Camel | CWE-918 Server-Side Request Forgery |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-48204 | Camel | CWE-284 Improper Access Control |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-48205 | Camel DNS | CWE-918 Server-Side Request Forgery |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-48206 | Camel JIRA | CWE-639 Authorization Bypass Through User-Controlled Key |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-49086 | Camel Dapr | CWE-441 Unintended Proxy or Intermediary |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-49097 | Camel | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-49098 | Camel | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-49099 | Camel Salesforce | CWE-639 Authorization Bypass Through User-Controlled Key |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-49365 | Camel | CWE-209 Generation of Error Message Containing Sensitive Information |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-53913 | Camel Keycloak | CWE-636 Not Failing Securely |
4.18.3, 4.21.0 |
reproducer |
| CVE-2026-55993 | Camel Atmosphere Websocket | CWE-918 Server-Side Request Forgery |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-55994 | Camel Iggy | CWE-918 Server-Side Request Forgery |
4.18.3, 4.21.0 |
reproducer |
| CVE-2026-56139 | Camel Undertow | CWE-209 Generation of Error Message Containing Sensitive Information |
4.14.8, 4.18.3, 4.21.0 |
reproducer |
| CVE-2026-56140 | Camel AWS2 SNS | CWE-20 Improper Input Validation |
4.14.8, 4.18.3, 4.21.0 |
- |
As a Camel maintainer I also build reproducers for reports that come in from outside, to confirm the issue and validate the fix. These are not my findings. Credit belongs to the reporters named below.
| CVE | Component | Class | Fixed in | Reported by | PoC |
|---|---|---|---|---|---|
| CVE-2024-22369 | Camel | CWE-502 Deserialization of Untrusted Data |
3.21.4, 3.22.1, 4.0.4, 4.4.0 |
Ziyang Chen from HuaWei Open Source Management Center, Pingtao Wei from HuaWei Open Source Management Center (finder) and Haoran Zhi from HuaWei Open Source Management Center | reproducer |
| CVE-2026-33453 | Camel | CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes |
4.14.5, 4.18.1 |
Hyunwoo Kim (@v4bel) | reproducer |
| CVE-2026-33454 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.6, 4.18.1 |
Hyunwoo Kim (@v4bel) | reproducer |
| CVE-2026-40022 | Camel Platform HTTP Main | CWE-288 Authentication Bypass Using an Alternate Path or Channel |
4.14.6, 4.18.2 |
Jihang Yu | reproducer |
| CVE-2026-40453 | Camel JMS | CWE-178 Improper Handling of Case Sensitivity |
4.14.6, 4.18.2, 4.20.0 |
Saroj Khadka | reproducer |
| CVE-2026-40473 | Camel Mina | CWE-502 Deserialization of Untrusted Data |
4.14.6, 4.18.2, 4.20.0 |
Venkatraman Kumar from Securin | reproducer |
| CVE-2026-40858 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.7, 4.18.2, 4.20.0 |
Feng Ning from Innora Pte. Ltd. | reproducer |
| CVE-2026-40859 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.8, 4.18.3, 4.20.0 |
Venkatraman Kumar from Securin | reproducer |
| CVE-2026-40860 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.7, 4.18.2, 4.20.0 |
Venkatraman Kumar from Securin | reproducer |
| CVE-2026-42527 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.8, 4.18.3, 4.21.0 |
Venkatraman Kumar from Securin and Yu Bao from Paypal | reproducer |
| CVE-2026-43865 | Camel | CWE-502 Deserialization of Untrusted Data |
4.14.8, 4.18.3, 4.21.0 |
gaorenyusi | reproducer |
| CVE-2026-46453 | Camel | CWE-639 Authorization Bypass Through User-Controlled Key |
4.14.8, 4.18.3, 4.21.0 |
Yu Bao from PayPal | reproducer |
| CVE-2026-46454 | Camel | CWE-20 Improper Input Validation |
4.14.8, 4.18.3, 4.21.0 |
Yu Bao from PayPal | reproducer |
| CVE-2026-46456 | Camel | CWE-20 Improper Input Validation |
4.14.8, 4.18.3, 4.21.0 |
Yu Bao from PayPal | reproducer |
| CVE-2026-46457 | Camel | CWE-20 Improper Input Validation |
4.14.8, 4.18.3, 4.21.0 |
Yu Bao from PayPal | reproducer |
| CVE-2026-46584 | Camel Mail | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
4.14.8, 4.18.3, r |
Yu Bao from PayPal | reproducer |
| CVE-2026-46587 | Camel | CWE-20 Improper Input Validation |
4.14.7, 4.18.2, 4.20.0 |
Yu Bao from PayPal | reproducer |
| CVE-2026-46588 | Camel | CWE-20 Improper Input Validation |
4.14.7, 4.18.2, 4.20.0 |
Yu Bao from PayPal | reproducer |
| CVE-2026-47323 | Camel | CWE-178 Improper Handling of Case Sensitivity |
4.14.6, 4.18.2 |
Quac Tran | reproducer |
| CVE-2026-49042 | Camel | CWE-20 Improper Input Validation |
4.18.2, 4.20.0 |
Yu Bao from PayPal | reproducer |
Findings are reported privately to the relevant ASF security team and published only after a fix ships. Reproducers target the vulnerable version and are intended for defenders validating their own exposure.