Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.camel:camel-lucene

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search…

    CVE-2026-46585 · GHSA-566h-v38h-3xp3

    Affected
    • Maven org.apache.camel:camel-lucene >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0
    Fixed in
    4.21.04.14.84.18.3· Vendor fix available
    Issue
    Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADERQUERY) whose value was the plain string QUERY (and RETURNLUCENEDOCS for HEADERRETURNLUCENEDOCS). Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that exposes a Lucene query operation behind an HTTP consumer (for example platform-http), any HTTP client could therefore set the QUERY header and have its value executed against the full-text index, overriding the query the route intended to run. Depending on what is indexed, this allows reading documents the request should not have access to (for example a match-all query returns the entire index, or the route's intended per-user…

    Recommended action: Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →