Apache Camel CVE-2026-56140: Defensive hardening for camel-aws2-sns header injection

Vulnerability Overview CVE-2026-56140 Severity: Low Summary: An inbound header filter was added to in the component to align with sibling components. Since is a producer (with no consumer), there is no reachable inbound header injection path. This is a defense-in-depth hardening measure related to the issue CVE-2026-46456. Affected Versions Affected Versions: - Before 4.0.0 - Before 4.14.8 - Before 4.15.0 - Before 4.18.3 - Before 4.19.0 - Before 4.21.0 Fix Solution Fixed Versions: - 4.14.8 - 4.18.3 - 4.21.0 Description The component filters Camel headers via component-specific ( ). Similar to the sibling component , it was initially configured with only an outbound filter ( ), blocking , , and headers from being written, and no inbound filter rules were configured. For the related component, this inbound vulnerability is exploitable because maps inbound SQS message attributes to Camel Exchange via , allowing message senders to inject Camel control headers (tracked as CVE-2026-46456). In contrast, is a producer with no consumer, so does not support consumers (creating a consumer throws ). You cannot receive messages from this endpoint; therefore, externally provided message attributes are never mapped to an inbound Camel Exchange via SNS, and is therefore not exploitable by an attacker. As part of the same fix (CAMEL-23506), inbound filter rules ( , for the Camel namespace) were added to so that its configuration aligns with the corrected and other sibling strategies. This is a defense-in-depth alignment with no known exploitation path. Notes The JIRA ticket (https://issues.apache.org/jira/browse/CAMEL-23506) references various commits resolving this issue and contains more details. The fix was merged into main (https://github.com/apache/camel/pull/23221) and backported to and . The change adds for the Camel namespace to to align its strategy with sibling components (Kafka, Mail, CoAP, Google Pub/Sub) and the corrected ; existing outbound filters remain unchanged. The issue is classified as CWE-20 (Improper Input Validation). Since is a producer with no consumer, there is no reachable inbound header injection path, meaning the actual impact is defense-in-depth hardening. The exploitable client-side variant pattern is the issue CVE-2026-46456, which shares the same fix (CAMEL-23506) with this change. It belongs to the same Camel message header injection family as CVE-2025-27636, CVE-2025-28891, CVE-2025-30177, CVE-2026-40453, CVE-2026-46454, and CVE-2026-47323, each involving missing blocks for the Camel header namespace when mapping inbound message headers to Exchange. Mitigation This is a defense-in-depth hardening measure with no known exploitation path, so no urgent action or workaround is required. Users seeking aligned behavior can upgrade to 4.21.0, the 4.14.x LTS release stream (4.14.8), or the 4.18.x release stream (4.18.3), which include this change. As a general best practice, operators should continue applying least-privilege IAM permissions to their SNS topics. References PGP-signed announcement data: CVE-2026-56140.txt.asc Mitre CVE Entry: https://www.cve.org/CVERecord?id=CVE-2026-56140

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel CVE-2026-56140: Defensive hardening for camel-aws2-sns header injection