Vulnerability	Vulnerable Version
C Improper Input Validation Affected versions of this package are vulnerable to Improper Input Validation through `CometdBinding.populateExchangeFromMessage` in `camel-cometd`. An attacker can inject Camel control headers into a CometD message by supplying an `ext.CamelHeaders` map when publishing to a CometD endpoint. The binding copies those client-supplied headers directly onto the Camel message without filtering, so headers such as `CamelHttpUri`, `CamelFileName`, or `CamelJmsDestinationName` can alter downstream producer behavior in the route. This can redirect HTTP requests, change file targets, override JMS destinations, or otherwise make the application process attacker-controlled header values. How to fix Improper Input Validation? Upgrade `org.apache.camel:camel-cometd` to version 4.14.8, 4.18.3, 4.21.0 or higher.	[,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

Improper Input Validation

Affected versions of this package are vulnerable to Improper Input Validation through CometdBinding.populateExchangeFromMessage in camel-cometd. An attacker can inject Camel control headers into a CometD message by supplying an ext.CamelHeaders map when publishing to a CometD endpoint. The binding copies those client-supplied headers directly onto the Camel message without filtering, so headers such as CamelHttpUri, CamelFileName, or CamelJmsDestinationName can alter downstream producer behavior in the route. This can redirect HTTP requests, change file targets, override JMS destinations, or otherwise make the application process attacker-controlled header values.

How to fix Improper Input Validation?

Upgrade org.apache.camel:camel-cometd to version 4.14.8, 4.18.3, 4.21.0 or higher.

[,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

Go back to all versions of this package