Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-56140: Apache Camel AWS SNS: Unsecured Input Headers Removed
CVE-2026-56140 · published 2 months ago
Summary
The Apache Camel AWS SNS component has fixed a security weakness that allowed malicious data to be injected into its system. This was not possible in this specific component because it does not receive messages from external sources. However, as a precautionary measure, the component has been updated to prevent potential security risks in the future. No action is required for users of this component.
What to do
- Update apache org.apache.camel:camel-aws2-sns to version 4.14.8.
- Update apache org.apache.camel:camel-aws2-sns to version 4.18.3.
- Update apache org.apache.camel:camel-aws2-sns to version 4.21.0.
- Update apache software foundation apache camel aws2 sns to version 4.14.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache camel aws2 sns | < 4.14.8 |
| – | apache | camel |
>= 4.0.0, < 4.14.8 >= 4.15.0, < 4.18.3 >= 4.19.0, < 4.21.0 cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* |
| maven | apache | org.apache.camel:camel-aws2-sns |
>= 4.0.0, < 4.14.8 >= 4.15.0, < 4.18.3 >= 4.19.0, < 4.21.0 Fix: upgrade to 4.14.8
|
Original advisory text
Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy
Improper Input Validation vulnerability in Apache Camel AWS SNS component.
The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns.
This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.
This is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.
The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns.
This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.
This is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.
References
- https://camel.apache.org/security/CVE-2026-56140.html vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56140
- https://github.com/apache/camel/pull/23221
- https://github.com/apache/camel/pull/23357
- https://github.com/apache/camel/pull/23373
- https://github.com/apache/camel/commit/5f57258fb33d33ef99df10594f8fe9f11d7c2b7e
- https://github.com/apache/camel/commit/7b334be0419839097a132d4ff3427fc4083e695e
- https://github.com/apache/camel/commit/b7f78292e747a28dbf5da444265557b5f9f3c1a1
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23506
- https://github.com/advisories/GHSA-w2v8-8q6c-3rhr
Severity
9.8
Critical
Exploitation
EPSS <1%
Type
CWE-20Improper Input Validation
Timeline
Published6 Jul 2026
Updated25 Sep 2026
First seen6 Jul 2026
Track software like this
Free during beta