Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-95664

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component

CVE-2026-95664: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache…

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Apache publishes the next one.

VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-95664 key facts

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
CVSS base score
5.4 (Apache), 5.4 (Red Hat)
Weakness
CWE-917
Fixed releases
  • Apache: 4.18.5, 4.22.2, 4.23.0, 4.8.0
  • Red Hat: 4.23.0, 4.22, 4.22.2, 4.18, 4.18.5
Vendor advisories
2 from Apache, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-95664; bulletin-wide values are not repeated here.

Is CVE-2026-95664 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-95664 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-95664?

Upgrade to a fixed release named by the vendor:

  • Apache: 4.18.5, 4.22.2, 4.23.0, 4.8.0
  • Red Hat: 4.23.0, 4.22, 4.22.2, 4.18, 4.18.5
  • Users are recommended to upgrade to version 4.23.0, which fixes the issue. (Apache)
  • If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. (Apache)
  • To mitigate this vulnerability without replacing component packages, configure Camel routes to prevent untrusted S3 object keys from reaching the aws2-s3 producer: 1. In routes transferring messages from an aws2-s3 consumer to an aws2-s3 producer, explicitly remove the `CamelAwsS3Key` header prior to the producer step using ` ` in XML DSL or `.removeHeader("CamelAwsS3Key")` in Java DSL. Define the intended object destination via the producer endpoint's `keyName` option. 2. Alternatively, insert route validation logic to reject or filter out exchanges whose `CamelAwsS3Key` header contains expression markers such as `${` or `$simple{`. 3. As an operational control, restrict write and upload permissions on source S3 buckets strictly to trusted principals. Warning: Modifying and applying route configuration changes requires reloading or restarting the affected integration services, which may cause a temporary service disruption. (Red Hat)

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium5.4

    Medium [CVE-2026-95664] Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component

    CVE-2026-95664Source published Source updated

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName option configured on the endpoint only when that header is absent. Since 4.8.0, AWS2S3Utils.determineKey() also passed the resulting value to the Simple language whenever it contained ${ or $simple{, so that a route could use a dynamic key, and the evaluation applied to a value taken from the header as well as to the configured option. The header is not route configuration, however: the…

    Affected products in this advisory
    • Apache Camel AWS2-s3
    Source-reported affected versions
    • 4.8.0 before 4.18.5
    • 4.19.0 before 4.22.2
    Source-reported fixed versions
    • 4.18.5
    • 4.22.2
    • 4.23.0
    • 4.8.0
    Mitigation guidance
    • Users are recommended to upgrade to version 4.23.0, which fixes the issue.
    • If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2.
    • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
    • After upgrading, a key or bucket name supplied through a message header is used literally, so a route that put an unevaluated Simple expression in the CamelAwsS3Key or CamelAwsS3OverrideBucketName header must evaluate it in the route instead, for example with setHeader and simple(), or configure it as the keyName or bucketName option of the endpoint.

    1 more entries in the full advisory.

    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium5.4

    Medium [CVE-2026-95664] Expression language injection via untrusted S3 object keys

    CVE-2026-95664Source published Source updated

    Expression language injection via untrusted S3 object keys. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-917. Affected products named by the advisory: OpenShift Serverless; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7.

    Related products — impact not confirmed
    • OpenShift Serverless
    • Red Hat build of Apache Camel 4 for Quarkus 3
    • Red Hat build of Apache Camel for Spring Boot 4
    • Red Hat Fuse 7
    Source-reported affected versions
    • < 4.8.0
    • < 4.18.5
    • < 4.19.0
    • < 4.22.2

    7 more entries in the full advisory.

    Source-reported fixed versions
    • 4.23.0
    • 4.22
    • 4.22.2
    • 4.18

    1 more entries in the full advisory.

    Mitigation guidance
    • To mitigate this vulnerability without replacing component packages, configure Camel routes to prevent untrusted S3 object keys from reaching the aws2-s3 producer: 1. In routes transferring messages from an aws2-s3 consumer to an aws2-s3 producer, explicitly remove the `CamelAwsS3Key` header prior to the producer step using `<removeHeader name="CamelAwsS3Key"/>` in XML DSL or `.removeHeader("CamelAwsS3Key")` in Java DSL. Define the intended object destination via the producer endpoint's `keyName` option. 2. Alternatively, insert route validation logic to reject or filter out exchanges whose `CamelAwsS3Key` header contains expression markers such as `${` or `$simple{`. 3. As an operational control, restrict write and upload permissions on source S3 buckets strictly to trusted principals. Warning: Modifying and applying route configuration changes requires reloading or restarting the affected integration services, which may cause a temporary service disruption.
    Full advisory and evidenceOpen source bulletin

More Apache advisories

All Apache advisories

Follow CVE-2026-95664 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features