Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-06T08:16:00 org.apache.camel/camel-aws2-sns: Apache Camel AWS SNS Component: Defense-in-depth hardening due to improper input validation 0.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. This is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.

A flaw was found in the Apache Camel AWS SNS component (`camel-aws2-sns`). An improper input validation vulnerability exists in the `Sns2HeaderFilterStrategy` due to a missing inbound filter rule. However, this component is producer-only, meaning it does not process external messages in a way that would allow an attacker to exploit this flaw. This issue is considered a defense-in-depth hardening change with no known exploit path.

A defense-in-depth hardening change was made to the Apache Camel AWS SNS component. The Sns2HeaderFilterStrategy lacked an inbound filter rule. However, camel-aws2-sns is producer-only and does not support consumers, so no externally-supplied message attributes are ever mapped inbound through SNS. This change aligns the SNS header filter strategy with the corrected SQS strategy. There is no known exploit path in camel-aws2-sns. No urgent action is required as there is no known exploit path. Users who want the aligned behavior can upgrade to Apache Camel 4.21.0, 4.14.8, or 4.18.3. OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Not affected camel-aws2-sns Red Hat build of Apache Camel for Spring Boot 4 Not affected camel-aws2-sns Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected camel-aws2-sns https://www.cve.org/CVERecord?id=CVE-2026-56140 https://nvd.nist.gov/vuln/detail/CVE-2026-56140 https://camel.apache.org/security/CVE-2026-56140.html