CVE Vulnerability Catalog

In fastllm up to 1.8.2, the SafeTensorItem::CreateBuffer function in src/model.cpp mishandles the data_offsets argument, causing a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.

FopProducer transforms the incoming XSL-FO body by creating a TransformerFactory via TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, that feature alone does not restrict external resource access, so an external DTD or entity declared in the XSL-FO document is resolved and expanded. An external sender can therefore read files readable by the Camel process and cause it to issue requests to hosts the document names.

A use of cache containing sensitive information vulnerability exists in the Apache Camel HTTP component. The JVM-global OAuth2 token cache key omitted the requested scope, resource indicator and token endpoint, so two endpoints differing only in those fields shared a cache entry and an endpoint could be served a token minted for a different scope, resource or authorization server.

An insufficient granularity of access control vulnerability exists in the Apache Camel Platform HTTP component. The component decided proxy mode by testing whether the configured path started with the string "proxy" rather than matching exactly, so endpoints such as proxyStatus or proxy-config became proxies without the route author's intent and forwarded requests onward.

A generation of error message containing sensitive information vulnerability exists in the Apache Camel gRPC component. When a route behind a gRPC consumer failed, the exception message was placed into the gRPC status description, which is transmitted to the calling client, so an external caller could read internal error messages including class and package names, paths, host names and connection details.

An improper input validation vulnerability exists in the Apache Camel Mail component. The MimeMultipart data format retained an unfiltered path where unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied, so an external sender could set them and influence how a downstream mail producer connects and sends.

A permissive cross-domain policy with untrusted domains vulnerability exists in the Apache Camel Jetty component. Setting enableCORS installed Jetty's CrossOriginFilter with stock defaults accepting every origin and allowing credentials, so a page on any origin could make credentialed cross-origin requests and read responses.

An improper input validation vulnerability exists in the Apache Camel Core component. The saga processor consulted a header named Long-Running-Action without a Camel prefix, so an external sender could supply it on an inbound message and name the saga the exchange joined, attaching their request to a long-running action started by someone else.

An improper authentication vulnerability exists in the Apache Camel Keycloak component. The security processor validated the token issuer only when the introspection response contained an iss claim; when absent, the check was skipped rather than treated as a failure, potentially allowing tokens from an unintended issuer to be accepted.

An incorrect default permissions vulnerability exists in the Apache Camel PQC component. When writing generated key material to disk, the component used the process default umask rather than restricting the file to its owner, potentially allowing other local accounts to read the private key.

An exposure of data element to wrong session vulnerability exists in the Apache Camel AS2 component. Signing material for an individual request was stored in state shared across requests, so with multiple trading partners a Message Disposition Notification could be signed with another partner's key.

A vulnerability in the Apache Camel MLLP component causes sensitive information (HL7 message payloads, including patient data) to be written to ordinary application logs. The logPhi option defaulted to true, and two additional code paths logged payload content regardless of its setting. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in the Apache Camel CXF component causes sensitive information to be exposed in SOAP error messages. When a route behind a CXF SOAP consumer fails with an exception not declared in the service contract, exception details (class and package names, message content, and optionally stack trace) are returned to the SOAP client in the faultstring or fault detail. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

An improper handling of case sensitivity vulnerability exists in the Apache Camel Platform HTTP component. The guard preventing request header reflection into the response compared header names case sensitively, while HTTP header names are case insensitive, allowing bypass by varying case; under HTTP/2 the suppression was inert for every request.

An improper input validation vulnerability exists in the Apache Camel Tika component. The Tika producer mapped every metadata key parsed from the submitted document onto the Exchange as a header without filtering, allowing attacker-controlled document content to set Camel namespace headers such as CamelFileName.

A race condition vulnerability exists in the Apache Camel PQC component due to concurrent execution using a shared resource with improper synchronization. The producer held a single java.security.Signature instance for every exchange without synchronization, causing interleaved update and verify calls under concurrent traffic.

Improper Certificate Validation vulnerability in Apache Camel Knative component. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client fell back to trusting every presented certificate instead of the JVM's default trust anchors. An attacker positioned on the network path can terminate and read the encrypted connection.

A vulnerability in the Apache Camel Mina component causes sensitive exception details to be sent back to the remote peer when exchange processing fails. Depending on the codec (textline or object), the peer may receive class names, messages, or even the serialized exception with its cause chain, potentially exposing paths, host names, and connection details. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in the Apache Camel Thrift component causes incoming data to be unmarshalled into the shared defaultInstance of the target type rather than a fresh copy. As a result, state from one message remains visible to subsequent messages of the same type, potentially leading to data disclosure between different senders.

Improper validation of the integrity check value in Apache Camel Crypto PGP component. The unmarshal() method verified the modification detection code only for OpenPGP symmetrically encrypted integrity protected data packets, skipping the check for older packets without such code, allowing the sender or a man-in-the-middle to decide whether integrity protection applied.