What is the CVSS score of CVE-2026-56140?

CVE-2026-56140 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-56140?

Apache Camel's AWS SNS connector carries a CRITICAL vulnerability rating for a message header validation deficiency, but real-world risk is negligible because the component operates in send-only mode…. A patch is available.

How to fix or mitigate CVE-2026-56140?

Within 24 hours: identify all Apache Camel deployments using the camel-aws2-sns component; within 7 days: apply the vendor-released patch to all identified systems during normal maintenance windows; within 30 days: confirm patch deployment and regression-test SNS producer workflows.

Apache Camel CVE-2026-56140

EUVD-2026-41852 CRITICAL

Improper Input Validation (CWE-20)

2026-07-05

GHSA-w2v8-8q6c-3rhr

Apache Microsoft Code Injection Red Hat Camel

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

0.0 LOW

Producer-only component has no reachable inbound path, so no confidentiality, integrity, or availability impact actually applies; effectively unexploitable, yielding a near-zero base score.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

0.0 LOW

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:16 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:18 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 maven packages depend on org.apache.camel:camel-aws2-sns (6 direct, 8 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Improper input validation (CWE-20) in the camel-aws2-sns component of Apache Camel stems from a missing inbound HeaderFilterStrategy rule on Sns2HeaderFilterStrategy, mirroring the flaw fixed in the sibling camel-aws2-sqs component (CVE-2026-46456). However, camel-aws2-sns is producer-only - Sns2Endpoint throws UnsupportedOperationException on createConsumer - so no externally-supplied SNS message attributes are ever mapped inbound into a Camel Exchange, leaving the missing filter rule unreachable by any attacker. Despite the NVD CVSS 9.8 rating, the vendor explicitly classifies this as a defense-in-depth alignment with no known exploit path, and EPSS scores it at just 0.16% (6th percentile); no public exploit identified at time of analysis.

Technical ContextAI

Apache Camel is a widely-used Java integration framework implementing Enterprise Integration Patterns; the camel-aws2-sns component bridges Camel routes to Amazon Simple Notification Service (SNS) using the AWS SDK v2. Camel components use a HeaderFilterStrategy to control which headers cross the boundary between the Camel Exchange and the external system. Sns2HeaderFilterStrategy originally configured only an outbound filter (setOutFilterPattern blocking Camel*, breadcrumbId, and org.apache.camel.* headers) and, like the pre-fix Sqs2HeaderFilterStrategy, lacked a corresponding inbound filter rule. The CWE-20 root cause is that inbound external headers were not validated/filtered against the Camel control namespace. In the SQS sibling this was exploitable because Sqs2Consumer maps inbound message attributes into the Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders; in SNS there is no consumer path, so no inbound mapping occurs. Fix CAMEL-23506 added setInFilterStartsWith for the Camel namespace to align Sns2HeaderFilterStrategy with its corrected siblings.

RemediationAI

Vendor-released patch: upgrade to 4.21.0, or 4.14.8 on the 4.14.x LTS stream, or 4.18.3 on the 4.18.x stream - all contain the CAMEL-23506 hardening change. Because the vendor confirms there is no known exploit path in the producer-only camel-aws2-sns component, no urgent action or workaround is required and no functional workaround is necessary; the upgrade simply aligns filter behaviour with the sibling components. As a standing best practice unrelated to this specific defect, apply least-privilege IAM permissions on SNS topics to constrain what a Camel route can publish. Consult the advisory at https://camel.apache.org/security/CVE-2026-56140.html before scheduling; this can safely follow normal maintenance cadence rather than emergency patching.