UpdatedSep 3, 2026
security-research — Updated!
Vulnerabilità che ho segnalato alla Apache Software Foundation: 46 CVE in 15 progetti
Security Research
Vulnerabilità che ho segnalato alla Apache Software Foundation, divulgate attraverso il processo di sicurezza ASF. 46 CVE su 15 progetti, dal 2023 al 2026.
Dove esiste un reproducer pubblico, questo è collegato. Ognuno è un progetto minimale e autonomo che dimostra il problema e indica la release che lo ha risolto.
Su 25 CWE distinti, due classi dominano: deserializzazione di dati non attendibili (7) e server-side request forgery (7).
Nell'ecosistema Apache: 16 CVE, 14 progetti
| CVE | Componente | Classe | Risolto in | PoC |
|---|---|---|---|---|
| CVE-2023-41313 | Doris | CWE-208 Observable Timing Discrepancy | 1.2.8 | - |
| CVE-2023-41834 | Flink Stateful Functions | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component | 3.3.0 | - |
| CVE-2023-43123 | Storm | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor | 2.6.0 | - |
| CVE-2024-23454 | Hadoop | CWE-378 Creation of Temporary File With Insecure Permissions | 3.4.0 | - |
| CVE-2024-23953 | Hive | CWE-208 Observable Timing Discrepancy | 4.0.0 | - |
| CVE-2024-29869 | Hive | CWE-732 Incorrect Permission Assignment for Critical Resource | 4.0.1 | - |
| CVE-2026-28672 | Ranger | CWE-77 Improper Neutralization of Special Elements used in a Command | 2.9.0 | reproducer |
| CVE-2026-34476 | SkyWalking MCP | CWE-918 Server-Side Request Forgery | non pubblicato | - |
| CVE-2026-40005 | IoTDB | CWE-22 Improper Limitation of a Pathname to a Restricted Directory | 2.0.10 | - |
| CVE-2026-40008 | IoTDB | CWE-470 Use of Externally-Controlled Input to Select Classes or Code | 2.0.10 | - |
| CVE-2026-40564 | Flink Kubernetes Operator | CWE-918 Server-Side Request Forgery | 1.15.0 | reproducer |
| CVE-2026-41041 | Gravitino | CWE-177 Improper Handling of URL Encoding | 1.2.1 | - |
| CVE-2026-44616 | Zeppelin | CWE-90 Improper Neutralization of Special Elements used in an LDAP Query | 0.12.1 | - |
| CVE-2026-49361 | Fluss (incubating) | CWE-400 Uncontrolled Resource Consumption | non pubblicato | - |
| CVE-2026-63039 | InLong | CWE-89 Improper Neutralization of Special Elements used in an SQL Command | 2.4.0 | reproducer |
| CVE-2026-64640 | Polaris | CWE-863 Incorrect Authorization | 1.7.0 | reproducer |
Apache Camel: 30 CVE
Camel è il progetto che mantengo, quindi riceve il maggior scrutinio. Il pattern dominante è header in ingresso non filtrati che raggiungono il control plane di un producer, più una lunga coda di deserializzazione non sicura nei percorsi di registry e migrazione.
| CVE | Componente | Classe | Risolto in | PoC |
|---|---|---|---|---|
| CVE-2024-23114 | Camel | CWE-502 Deserialization of Untrusted Data | 3.21.4, 3.22.1, 4.0.4, 4.4.0 | - |
| CVE-2026-23552 | Camel | CWE-346 Origin Validation Error | 4.18.0 | reproducer |
| CVE-2026-25747 | Camel LevelDB | CWE-502 Deserialization of Untrusted Data | 4.10.9, 4.14.5, 4.18.0 | reproducer |
| CVE-2026-27172 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.6, 4.18.1 | reproducer |
| CVE-2026-40047 | Camel | CWE-88 Improper Neutralization of Argument Delimiters in a Command | 4.18.3 | reproducer |
| CVE-2026-40048 | Camel PQC | CWE-502 Deserialization of Untrusted Data | 4.18.2, 4.20.0 | reproducer |
| CVE-2026-43866 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-43867 | Camel | CWE-502 Deserialization of Untrusted Data | 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46455 | Camel | CWE-613 Insufficient Session Expiration | 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46585 | Camel Lucene | CWE-639 Authorization Bypass Through User-Controlled Key | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46590 | Camel | CWE-502 Deserialization of Untrusted Data | 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46591 | Camel | CWE-943 Improper Neutralization of Special Elements in Data Query Logic | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46592 | Camel | CWE-441 Unintended Proxy or Intermediary | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46726 | Camel Vertx Websocket | CWE-918 Server-Side Request Forgery | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-48203 | Camel | CWE-918 Server-Side Request Forgery | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-48204 | Camel | CWE-284 Improper Access Control | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-48205 | Camel DNS | CWE-918 Server-Side Request Forgery | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-48206 | Camel JIRA | CWE-639 Authorization Bypass Through User-Controlled Key | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-49086 | Camel Dapr | CWE-441 Unintended Proxy or Intermediary | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-49097 | Camel | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-49098 | Camel | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-49099 | Camel Salesforce | CWE-639 Authorization Bypass Through User-Controlled Key | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-49365 | Camel | CWE-209 Generation of Error Message Containing Sensitive Information | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-53913 | Camel Keycloak | CWE-636 Not Failing Securely | 4.18.3, 4.21.0 | reproducer |
| CVE-2026-55993 | Camel Atmosphere Websocket | CWE-918 Server-Side Request Forgery | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-55994 | Camel Iggy | CWE-918 Server-Side Request Forgery | 4.18.3, 4.21.0 | reproducer |
| CVE-2026-56139 | Camel Undertow | CWE-209 Generation of Error Message Containing Sensitive Information | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-56140 | Camel AWS2 SNS | CWE-20 Improper Input Validation | 4.14.8, 4.18.3, 4.21.0 | - |
| CVE-2026-63621 | Camel Knative | CWE-20 Improper Input Validation | 4.14.9, 4.18.4, 4.22.0 | reproducer |
| CVE-2026-78329 | Camel Undertow | CWE-20 Improper Input Validation | 4.14.9, 4.18.4, 4.22.0 | reproducer |
Reproducer per problemi trovati da altri: 26
Come maintainer di Camel costruisco anche reproducer per le segnalazioni che arrivano dall'esterno, per confermare il problema e validare la correzione. Questi non sono miei risultati. Il merito va ai segnalatori indicati di seguito.
| CVE | Componente | Classe | Risolto in | Segnalato da | PoC |
|---|---|---|---|---|---|
| CVE-2024-22369 | Camel | CWE-502 Deserialization of Untrusted Data | 3.21.4, 3.22.1, 4.0.4, 4.4.0 | Ziyang Chen from HuaWei Open Source Management Center, Pingtao Wei from HuaWei Open Source Management Center (finder) and Haoran Zhi from HuaWei Open Source Management Center | reproducer |
| CVE-2026-33453 | Camel | CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes | 4.18.1, 4.19.0 | Hyunwoo Kim (@v4bel) | reproducer |
| CVE-2026-33454 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.6, 4.18.1 | Hyunwoo Kim (@v4bel) | reproducer |
| CVE-2026-40022 | Camel Platform HTTP Main | CWE-288 Authentication Bypass Using an Alternate Path or Channel | 4.14.6, 4.18.2 | Jihang Yu | reproducer |
| CVE-2026-40453 | Camel JMS | CWE-178 Improper Handling of Case Sensitivity | 4.14.6, 4.18.2, 4.20.0 | Saroj Khadka | reproducer |
| CVE-2026-40473 | Camel Mina | CWE-502 Deserialization of Untrusted Data | 4.14.6, 4.18.2, 4.20.0 | Venkatraman Kumar from Securin | reproducer |
| CVE-2026-40858 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.7, 4.18.2, 4.20.0 | Feng Ning from Innora Pte. Ltd. | reproducer |
| CVE-2026-40859 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.8, 4.18.3, 4.20.0 | Venkatraman Kumar from Securin | reproducer |
| CVE-2026-40860 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.7, 4.18.2, 4.20.0 | Venkatraman Kumar from Securin | reproducer |
| CVE-2026-42527 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.8, 4.18.3, 4.21.0 | Venkatraman Kumar from Securin and Yu Bao from Paypal | reproducer |
| CVE-2026-43865 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.8, 4.18.3, 4.21.0 | gaorenyusi | reproducer |
| CVE-2026-46453 | Camel | CWE-639 Authorization Bypass Through User-Controlled Key | 4.14.8, 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-46454 | Camel | CWE-20 Improper Input Validation | 4.14.8, 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-46456 | Camel | CWE-20 Improper Input Validation | 4.14.8, 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-46457 | Camel | CWE-20 Improper Input Validation | 4.14.8, 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-46584 | Camel Mail | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor | 4.14.8, 4.18.3, r | Yu Bao from PayPal | reproducer |
| CVE-2026-46587 | Camel | CWE-20 Improper Input Validation | 4.14.8, 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-46588 | Camel | CWE-20 Improper Input Validation | 4.14.8, 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-47323 | Camel | CWE-178 Improper Handling of Case Sensitivity | 4.14.6, 4.18.2 | Quac Tran | reproducer |
| CVE-2026-49042 | Camel | CWE-20 Improper Input Validation | 4.18.3, 4.21.0 | Yu Bao from PayPal | reproducer |
| CVE-2026-59230 | Camel Mail | CWE-20 Improper Input Validation | 4.14.9, 4.18.4, 4.22.0 | Atuin - Automated Vulnerability Discovery Engine, anciety of Tencent Xuanwu Lab | reproducer |
| CVE-2026-60093 | Camel Azure Storage Datalake | CWE-22 Improper Limitation of a Pathname to a Restricted Directory | 4.14.9, 4.18.4, 4.22.0 | n0mi1k and Hiep Nguyen | reproducer |
| CVE-2026-66906 | Camel Azure Storage Blob | CWE-22 Improper Limitation of a Pathname to a Restricted Directory | 4.14.9, 4.18.4, 4.22.0 | n0mi1k and Hiep Nguyen | reproducer |
| CVE-2026-66907 | Camel Google Storage | CWE-22 Improper Limitation of a Pathname to a Restricted Directory | 4.14.9, 4.18.4, 4.22.0 | n0mi1k | reproducer |
| CVE-2026-66908 | Camel Platform HTTP Main | CWE-287 Improper Authentication | 4.22.0 | n0mi1k | reproducer |
| CVE-2026-71300 | Camel Atmosphere Websocket | CWE-20 Improper Input Validation | 4.14.9, 4.18.4, 4.22.0 | Barak Srour from Apiiro | reproducer |
I risultati vengono segnalati privatamente al team di sicurezza ASF competente e pubblicati solo dopo il rilascio di una correzione. I reproducer sono mirati alla versione vulnerabile e sono destinati ai difensori che validano la propria esposizione.