{"answers":{"affected":"6 open source packages ship an affected version, including org.apache.camel:camel-aws2-sns. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-56140 in the wild and no public exploit code.","fix":"Upgrade org.apache.camel:camel-aws2-sns to a fixed version for your release line: 4.14.8, 4.18.3 or 4.21.0.","what":"CVE-2026-56140 is a critical vulnerability in Apache Camel, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-56140 and fix it if it is affected.\n\nWhat it is: CVE-2026-56140 is a critical vulnerability in Apache Camel, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-56140 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.camel:camel-aws2-sns (Maven): affected from 4.0.0; fixed in 4.14.8\n- org.apache.camel:camel-aws2-sns (Maven): affected from 4.0.0; fixed in 4.14.8\n- org.apache.camel:camel-aws2-sns (Maven): affected from 4.15.0; fixed in 4.18.3\n- org.apache.camel:camel-aws2-sns (Maven): affected from 4.15.0; fixed in 4.18.3\n- org.apache.camel:camel-aws2-sns (Maven): affected from 4.19.0; fixed in 4.21.0\n- org.apache.camel:camel-aws2-sns (Maven): affected from 4.19.0; fixed in 4.21.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-56140/ (Markdown: https://insights.sbomify.com/CVE-2026-56140/index.md)","id":"CVE-2026-56140","markdown":"https://insights.sbomify.com/CVE-2026-56140/index.md","name":"CVE-2026-56140","record":{"aliases":["GHSA-w2v8-8q6c-3rhr"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["other"],"network_reachable":"yes","non_default_config":false,"product_category":"Apache Camel AWS2 SNS","requires_auth":"none","summary":"Defense-in-depth hardening for Apache Camel AWS2 SNS component aligning header filters, with no known exploit path due to producer-only nature.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"camel","vendor":"apache"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Improper Input Validation vulnerability in Apache Camel AWS SNS component.\n\nThe camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nThis is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy","id":"CVE-2026-56140","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":"apache:camel","products":["apache:camel"],"type":"other","year":"2026"},"n_packages":6,"n_references":1,"next":{"headline":"Weak cryptography in Hub","id":"CVE-2026-56141"},"packages":[{"ecosystem":"Maven","fixed":["4.14.8"],"introduced":["4.0.0"],"last_affected":[],"package":"org.apache.camel:camel-aws2-sns","purl":null,"source":"GHSA-w2v8-8q6c-3rhr"},{"ecosystem":"Maven","fixed":["4.14.8"],"introduced":["4.0.0"],"last_affected":[],"package":"org.apache.camel:camel-aws2-sns","purl":"pkg:maven/org.apache.camel/camel-aws2-sns","source":"GHSA-w2v8-8q6c-3rhr"},{"ecosystem":"Maven","fixed":["4.18.3"],"introduced":["4.15.0"],"last_affected":[],"package":"org.apache.camel:camel-aws2-sns","purl":null,"source":"GHSA-w2v8-8q6c-3rhr"},{"ecosystem":"Maven","fixed":["4.18.3"],"introduced":["4.15.0"],"last_affected":[],"package":"org.apache.camel:camel-aws2-sns","purl":"pkg:maven/org.apache.camel/camel-aws2-sns","source":"GHSA-w2v8-8q6c-3rhr"},{"ecosystem":"Maven","fixed":["4.21.0"],"introduced":["4.19.0"],"last_affected":[],"package":"org.apache.camel:camel-aws2-sns","purl":null,"source":"GHSA-w2v8-8q6c-3rhr"},{"ecosystem":"Maven","fixed":["4.21.0"],"introduced":["4.19.0"],"last_affected":[],"package":"org.apache.camel:camel-aws2-sns","purl":"pkg:maven/org.apache.camel/camel-aws2-sns","source":"GHSA-w2v8-8q6c-3rhr"}],"prev":{"headline":"Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body","id":"CVE-2026-56139"},"products":["Apache Camel AWS2 SNS"],"published":"2026-07-06","related":[{"cvss_score":10,"headline":"Apache camel-coap allows header injection that can lead to remote code execution","id":"CVE-2026-33453","kev_date_added":null,"published":"2026-04-27"},{"cvss_score":9.9,"headline":"Apache Camel has an incomplete fix for CVE-2025-27636","id":"CVE-2026-40453","kev_date_added":null,"published":"2026-04-27"},{"cvss_score":9.8,"headline":"Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod","id":"CVE-2026-80351","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":9.8,"headline":"Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects","id":"CVE-2026-80352","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":9.8,"headline":"Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection","id":"CVE-2026-71300","kev_date_added":null,"published":"2026-08-24"},{"cvss_score":9.8,"headline":"Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes","id":"CVE-2026-78329","kev_date_added":null,"published":"2026-08-24"},{"cvss_score":9.8,"headline":"Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter","id":"CVE-2026-43867","kev_date_added":null,"published":"2026-07-06"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-06","vendors":["Apache Software Foundation"]},"summary":"Defense-in-depth hardening for Apache Camel AWS2 SNS component aligning header filters, with no known exploit path due to producer-only nature.","url":"https://insights.sbomify.com/CVE-2026-56140/"}