Improper Input Validation in Apache Camel Core Component

CVE-2026-85312

What is CVE-2026-85312?

An Improper Input Validation vulnerability exists in the Apache Camel Core component, specifically affecting versions prior to 4.18.5 and 4.22.1. This vulnerability arises from the saga processor’s handling of the Long-Running-Action header, which external senders can manipulate to improperly influence the saga an exchange belongs to. When this header is sent, it can link an incoming request to a saga initiated by another party, potentially compromising operations associated with that saga. Consequently, this poses a risk in scenarios using sagas managed by an LRA coordinator. Users are advised to upgrade to Apache Camel 4.23.0 or the appropriate patched versions to mitigate risk. For those unable to upgrade, it is recommended to remove the Long-Running-Action header at the trust boundary in all untrusted message consumers.

References