CVE-2026-56140
Description
A flaw was found in the Apache Camel AWS SNS component (camel-aws2-sns). An improper input validation vulnerability exists in the Sns2HeaderFilterStrategy due to a missing inbound filter rule. However, this component is producer-only, meaning it does not process external messages in a way that would allow an attacker to exploit this flaw. This issue is considered a defense-in-depth hardening change with no known exploit path.
Statement
A defense-in-depth hardening change was made to the Apache Camel AWS SNS component. The Sns2HeaderFilterStrategy lacked an inbound filter rule. However, camel-aws2-sns is producer-only and does not support consumers, so no externally-supplied message attributes are ever mapped inbound through SNS. This change aligns the SNS header filter strategy with the corrected SQS strategy. There is no known exploit path in camel-aws2-sns.
Mitigation
No urgent action is required as there is no known exploit path. Users who want the aligned behavior can upgrade to Apache Camel 4.21.0, 4.14.8, or 4.18.3.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 0 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
