Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.camel:camel-jira

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter

    CVE-2026-48206 · GHSA-64gv-6cq2-45jr

    Affected
    • Maven org.apache.camel:camel-jira >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0
    Fixed in
    4.21.04.14.84.18.3· Vendor fix available
    Issue
    Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their operation parameters - the issue key, project key, transition id, summary, type, assignee, components, watchers, link type, work-log minutes and others - from Exchange message headers. The header constants defined in JiraConstants (for example ISSUEKEY = IssueKey, ISSUEPROJECTKEY = ProjectKey, ISSUETRANSITIONID = IssueTransitionId, LINKTYPE = linkType) used plain, non-Camel-prefixed values. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a jira: producer, any HTTP client could therefore supply these headers and override the values the route intended, driving JIRA operations…

    Recommended action: Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Low, CVSS 3.3MavenPublished

    Apache Camel information exposure vulnerability

    CVE-2023-34442 · GHSA-6g2w-257v-3c9f

    Affected
    • Maven org.apache.camel:camel-jira >= 3.0.0-M3, < 3.14.9; >= 3.15.0, < 3.18.8; >= 3.20.0, < 3.20.6; >= 4.0.0-M1, <= 4.0.0-M3
    Fixed in
    3.18.83.14.93.20.64.0.0-RC1· Vendor fix available
    Issue
    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel. This issue affects Apache Camel from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3. Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-RC1

    Recommended action: Upgrade to 4.0.0-RC1 (pre-release), 3.20.6, 3.18.8 or 3.14.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →