Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-63621

CVE-2026-63621: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2025-27636 +5] Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers

    CVE-2026-63621Source published Source updated

    This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri…

    Affected products in this advisory
    • Apache Camel Knative
    Source-reported affected versions
    • 3.15.0 before 4.14.9
    • 4.15.0 before 4.18.4
    • 4.19.0 before 4.21.0
    • through 4.17.0

    1 more entries in the full advisory.

    Source-reported fixed versions
    • 4.14.9
    • 4.18.4
    • 4.21.0
    • 4.22.0
    Mitigation guidance
    • Users are recommended to upgrade to version 4.22.0, which fixes the issue.
    • If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.4.
    • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
    • The non-LTS releases 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected but do not receive a maintenance fix; users on those versions should upgrade to 4.18.4 or 4.22.0.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.3

    High [CVE-2026-63621] Header injection vulnerability allows server-side request forgery

    CVE-2026-63621Source published Source updated

    Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri…

    Affected products in this advisory
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
    • OpenShift Serverless
    Source-reported affected versions
    • < 3.15.0
    • < 4.14.9
    • < 4.15.0
    • < 4.18.4

    5 more entries in the full advisory.

    Source-reported fixed versions
    • 4.22.0
    • 4.18
    • 4.18.4
    • 4.14

    3 more entries in the full advisory.

    Mitigation guidance
    • Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features