CVE-2026-49042— Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.8.0≤ 4.18.2 | affected |
4.19.0≤ 4.20.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49042
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Camel 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache camel是美国Apache基金会开源的一个企业集成模式框架。 Apache Camel 4.8.0至4.18.2版本和4.19.0至4.20.0版本存在输入验证错误漏洞，该漏洞源于输入验证不当，可能导致网络攻击者低复杂度攻击，造成机密性、完整性和可用性低影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.8.0 ~ 4.18.2 | - |
II. Public POCs for CVE-2026-49042
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49042
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49042 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-06 · 39 CVEs total
| CVE-2026-46457 | Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange withou | |
| CVE-2026-48205 | Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed nam | |
| CVE-2026-48204 | Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed n | |
| CVE-2026-48203 | Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non- | |
| CVE-2026-46726 | Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket quer | |
| CVE-2026-46592 | Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed name | |
| CVE-2026-46591 | Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header a | |
| CVE-2026-46590 | Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle manager | |
| CVE-2026-46585 | Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETUR | |
| CVE-2026-46584 | Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail | |
| CVE-2026-48206 | Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP h | |
| CVE-2026-46456 | Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange with | |
| CVE-2026-46455 | Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the | |
| CVE-2026-46454 | Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange wi | |
| CVE-2026-46453 | Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel | |
| CVE-2026-43865 | Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed H | |
| CVE-2026-42527 | Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables | |
| CVE-2026-40859 | Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a | |
| CVE-2026-40047 | Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argum | |
| CVE-2026-56139 | Apache Camel Undertow: The muteException consumer option defaulted to false, so a processi |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Camel
- CVE-2026-46588
Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers b - CVE-2026-46587
Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers - CVE-2026-43866
Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix b - CVE-2026-43867
Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecyc - CVE-2026-49365
Apache Camel: Camel-Netty-HTTP: The muteException consumer o
Same vendor: Apache Software Foundation
- CVE-2026-49844
Apache Log4j API: Improper serialization of non-finite float - CVE-2026-40454
Apache IoTDB C++ client: Out-of-bounds reads in C++ client T - CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery - CVE-2026-40009
Apache IoTDB: Authenticated users can escalate to full tree- - CVE-2026-40008
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfe
Same weakness: CWE-20
- CVE-2026-3576
Planyo online reservation system <= 3.0 - Unauthenticated Se - CVE-2026-15288
SureForms – Drag and Drop Form Builder for WordPress <= 2.2. - CVE-2026-0282
PAN-OS: File Deletion Vulnerability in Management Web Interf - CVE-2025-58146
XAPI UTF-8 string handling - CVE-2026-15122
Chrome<150.0.7871.115代码编解码器输入验证不足漏洞
V. Comments for CVE-2026-49042
No comments yet