CVE-2026-80344

--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to constrain asynchronous MDN receipt destinations in the AS2 receiver to an approved host allowlist before establishing outbound socket connections: upgrade to Apache Camel 4.18.5, 4.22.1, 4.23.0 (or the fixed Camel As builds), which validates target hosts against an asyncMdnAllowedHosts allowlist, strips outbound authentication credentials if unconfigured, and enforces HTTP scheme restrictions, closing all 2 injection vectors (inbound AS2 message with crafted Receipt-Delivery-Option header, unvalidated asynchronous MDN delivery address). Until patched, this is a concern on deployments exposing Camel AS2 receiver endpoints accessible to inbound network traffic, so restrict outbound network connectivity from the AS2 receiver to authorized partner endpoints and avoid attaching credentials to MDN delivery that are valid outside trusted destinations. As a compensating measure, enforce allowlist-based validation on the Receipt-Delivery-Option header value to reject arbitrary receipt destination addresses and restrict outbound network egress to only approved partner endpoints to contain connections to internal networks and metadata services. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated receipt destination SSRF defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1304 SSRF Prevention (Outbound Request Allowlist) (high)