CVE-2026-80344
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component
CVE-2026-80344: Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. Not in the CISA KEV catalog.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-80344 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 8.2 (Apache), 8.2 (Red Hat)
- Weakness
- CWE-918
- Fixed releases
- Apache: 4.18.5, 4.22.1
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-80344; bulletin-wide values are not repeated here.
Is CVE-2026-80344 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-80344 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-80344?
Upgrade to a fixed release named by the vendor:
- Apache: 4.18.5, 4.22.1
- Upgrade to Apache Camel 4.23.0, which fixes the issue. (Apache)
- Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. (Apache)
Vendor advisory comparison
Apache
1 advisory- Advisory severityHigh8.2
High [CVE-2026-80344] Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component
CVE-2026-80344Source published Source updated
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound…
- Affected products in this advisory
- Apache Camel AS2
- Source-reported affected versions
- 4.0.0 before 4.18.5
- 4.19.0 before 4.22.1
- Source-reported fixed versions
- 4.18.5
- 4.22.1
- Mitigation guidance
- Upgrade to Apache Camel 4.23.0, which fixes the issue.
- Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
- Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
- Workarounds
- For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.
Red Hat
1 advisory- Advisory severityHigh8.2
High [CVE-2026-80344] Server-Side Request Forgery via unvalidated receipt destination
CVE-2026-80344Source published Source updated
Server-Side Request Forgery via unvalidated receipt destination. Red Hat rates this important (CVSS 8.2). Weakness: CWE-918. Affected product named by the advisory: Red Hat Fuse 7.
- Related products — impact not confirmed
- Red Hat Fuse 7
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.