early signals oss-security infra

CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

// summary

CVE-2026-95664 affects Apache Camel’s AWS2-S3 producer, which evaluates untrusted S3 object keys from the CamelAwsS3Key header as simple expressions.

// from the source

Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3.1: 5.4 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected versions: - Apache Camel (org.apache.camel:camel-aws2-s3) 4.8.0 before 4.18.5 - Apache Camel (org.apache.camel:camel-aws2-s3) 4.19.0 before 4.22.2 Description: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    Ruby Regexp compilation fixes related to GitLab's CVE's

    seclists.org
  2. oss-security infra

    PHP Informational advisory: Session upload progress (CVE-2026-115560)

    seclists.org
  3. oss-security

    CVE-2026-115748: Apache Vysper: Authorization bypass

    seclists.org
  4. oss-security

    CVE-2026-115721: Apache Vysper: Unbounded allocation

    seclists.org
  5. oss-security

    CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input

    seclists.org