Expression Language Injection Vulnerability in Apache Camel's AWS2-S3 Component

CVE-2026-95664

What is CVE-2026-95664?

An Expression Language Injection vulnerability in the AWS2-S3 component of Apache Camel allows unauthorized manipulation of expressions used in messages. The flaw exists because the producer of the AWS2-S3 component sometimes evaluates headers containing dynamic keys improperly, which can lead to exposure of sensitive information stored in JVM system properties, environment variables, or configuration properties. Attackers able to control object names in a consumed S3 bucket can craft expressions that the producer evaluates, posing significant security risks. Users should upgrade to Apache Camel version 4.23.0 or later to mitigate the risk from this security vulnerability.

References