Medium, CVSS 5.3MavenAmendedPublished
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
CVE-2026-63621 · GHSA-vvwm-3j43-7pfm
- Affected
- Maven org.apache.camel:camel-knative >= 3.15.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0
- Fixed in
- 4.22.04.14.94.18.4· Vendor fix available
- Issue
- Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri, CamelHttpPath, CamelFileName) via a structured-mode CloudEvent request, matched case-insensitively against Camel's header map. When a route forwards messages from a Knative consumer to a header-driven…
Recommended action: Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.