CVE-2026-46456

Critical [CVE-2026-46456 +1] Improper Input Validation vulnerability in Apache Camel AWS SNS component

CVE-2026-56140Source published Jul 6, 2026Source updated Jul 9, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns. This…

Affected products in this advisory

• Apache Camel AWS

Source-reported affected versions

• 4.0.0 through 4.14.8
• 4.15.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.14.8
• 4.14.x
• 4.18.3

1 more entries in the full advisory.

Mitigation guidance

• Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule.
• Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change.
• As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.

Critical [CVE-2026-46456] Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component

CVE-2026-46456Source published Jul 6, 2026Source updated Jul 8, 2026

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not configure an inbound filter. As a result, when Sqs2Consumer copies each SQS MessageAttribute into the Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, DefaultHeaderFilterStrategy applied no inbound rule and treated every header name as not filtered - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelSqlQuery - copying them unmodified onto the…

Affected products in this advisory

• Apache Camel AWS2-SQS

Source-reported affected versions

• 4.0.0 through 4.14.8
• 4.15.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.14.8
• 4.18.3

Mitigation guidance

• Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not configure an inbound filter.
• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.

Workarounds

• For deployments that cannot upgrade immediately, strip the Camel control headers from inbound messages before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), and restrict who may send to the consumed SQS queue by applying least-privilege sqs:SendMessage permissions on the queue resource policy.