CVE-2026-95664
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
02 Description
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.30% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 22.6% of scored records. A rank, not a probability.
- NVD base score
- 5.4 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-10-28.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-26 08:40Z3 DAYS AGO
- Last updated
- 2026-10-26 08:40Z3 DAYS AGO
- Reserved
- 2026-09-22
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.4)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')Base
- Data version
- 5.2
- Document digest
- 92d182c8638845bcc2bb150aee13f9550571f2c9788daa2df9c58cdc1eb472f6
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-95664https://camel.apache.org/security/CVE-2026-95664.html
- issues.apache.orgCAMEL-24901https://issues.apache.org/jira/browse/CAMEL-24901
- github.comFix on main, released in 4.23.0 (commit 1fd7a667913ad068c8571b39c96b0a9c2dd4f3ef)https://github.com/apache/camel/pull/26746
- github.comBackport to camel-4.22.x for 4.22.2 (commit 19a672aa791480bff6b61c0551c79b2fa079da6e)https://github.com/apache/camel/pull/26840
- github.comBackport to camel-4.18.x, released in 4.18.5 (commit 124bf3da3cfb5d8e1994471e1301b6421bfe96d2)https://github.com/apache/camel/pull/26842
- github.comUpgrade-guide documentation for the 4.22.x and 4.18.x lines placed on main (commit aa48bb8a90adfae80a657a9ef427002d6634af31)https://github.com/apache/camel/pull/26841
- github.comJavadoc of the header and configuration contract in AWS2S3Utils on main (commit 60c2c38b98ebbbaf56c10aff491291afe13df474)https://github.com/apache/camel/pull/26889
- issues.apache.orgCAMEL-20971, the dynamic key and bucket name support added in 4.8.0 that introduced the evaluationhttps://issues.apache.org/jira/browse/CAMEL-20971
- camel.apache.orgCVE-2026-78164, HTTP producers resolved property placeholders in message-supplied URI override headers (same family)https://camel.apache.org/security/CVE-2026-78164.html
- camel.apache.orgCVE-2026-83531, dynamic-router-control endpoint compiled predicate expressions supplied by control messages (same family)https://camel.apache.org/security/CVE-2026-83531.html
- camel.apache.orgCVE-2025-27636, Camel message header injection via improper filtering (distinct from this issue)https://camel.apache.org/security/CVE-2025-27636.html
07 Remediation
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.8.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. AWS2S3Utils.determineKey() and determineBucketName() now evaluate the Simple language only for the keyName and bucketName options configured on the endpoint, which the route author writes; a key supplied through the CamelAwsS3Key header, or a bucket name supplied through the CamelAwsS3OverrideBucketName header, is used literally. A route that put an unevaluated Simple expression in one of these headers must evaluate it in the route instead, for example with setHeader and simple(), or configure it as the keyName or bucketName option of the endpoint.