Apache: Batch of 11 CVEs Hits Camel, Allura, and More on August 23-24, 2026
Key findings • Eleven vulnerabilities disclosed across Apache Camel, Allura, HttpAsyncClient, and Perl's App::Samurai::Util between August 23-24, 2026. • Multiple Apache Camel components affe…
Key findings
- Eleven vulnerabilities disclosed across Apache Camel, Allura, HttpAsyncClient, and Perl's App::Samurai::Util between August 23-24, 2026.
- Multiple Apache Camel components affected by improper input validation and relative path traversal flaws.
- Vulnerabilities include improper authentication, unauthenticated REST disclosure, and memory leaks.
- Affected Apache Camel versions range widely; specific upgrade paths provided for Camel, Allura, and others.
- Patching and upgrading are critical to mitigate risks across the affected Apache projects.
On August 23rd and 24th, 2026, a batch of eleven vulnerabilities was disclosed across various Apache projects, with a significant number impacting Apache Camel. These vulnerabilities range in severity and affect components such as Undertow, Atmosphere Websocket, Platform HTTP Main, Google Storage, Azure Storage Blob, Knative, Azure-Storage Datalake, and the core Camel framework itself. Additionally, vulnerabilities were found in Apache Allura and Apache HttpAsyncClient, alongside a session key predictability issue in Perl's App::Samurai::Util.
Several Apache Camel components are affected by improper input validation and relative path traversal vulnerabilities. CVE-2026-78329, CVE-2026-71300, CVE-2026-66907, CVE-2026-66906, CVE-2026-60093, and CVE-2026-59230 all stem from flaws in how input is handled or how file paths are processed within their respective components. Specifically, the Undertow and Atmosphere Websocket components suffer from improper input validation, while the Google Storage, Azure Storage Blob, and Azure-Storage Datalake components are vulnerable to relative path traversal, potentially allowing attackers to access or manipulate files outside of intended directories. CVE-2026-63621, affecting the Knative component, also involves improper input validation and neutralization of special elements.
Beyond input validation and path traversal, other vulnerabilities were disclosed. CVE-2026-66908, impacting the Apache Camel Platform HTTP Main component, is an improper authentication vulnerability related to JWT configuration. Apache Allura is affected by CVE-2026-75099, an unauthenticated REST disclosure of certain content items. A memory leak vulnerability, CVE-2026-59295, affects Micrometer-instrumented Apache HttpAsyncClient usage when asynchronous requests fail. Lastly, CVE-2026-19565, found in Perl's App::Samurai::Util, involves predictable session authentication keys generated from system time and process ID.
The affected versions for Apache Camel span a wide range, with many vulnerabilities fixed in versions 4.14.9, 4.18.4, and 4.22.0, depending on the specific component and affected release trains. For Apache Allura, users are recommended to upgrade to version 1.20.0. The Apache HttpAsyncClient vulnerability is addressed in versions that mitigate the memory leak issue, though specific version numbers for the fix were not detailed in the advisories. The Perl App::Samurai::Util vulnerability is present in versions through 1.01.
This batch of vulnerabilities highlights ongoing security challenges within the Apache ecosystem, particularly concerning input validation and path handling in complex components like Apache Camel. Users are strongly advised to consult the specific advisories for each CVE and apply the recommended patches and upgrades promptly to mitigate potential risks. The diverse nature of these flaws underscores the importance of continuous security monitoring and timely updates across all deployed Apache software.