CYBER CODE RED

Get real-time updates on Telegram

VULNERABILITYOpen Source Security

CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3.1: 5.4 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected versions: - Apache Camel (org.apache.camel:camel-aws2-s3) 4.8.0 before 4.18.5 - Apache Camel (org.apache.camel:camel-aws2-s3) 4.19.0 before 4.22.2 Description: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component.

Published 23-Oct-2026 17:33 UTC · First seen 23-Oct-2026 17:32 UTC

Sources