CVE-2026-80344

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description A Server-Side Request Forgery (SSRF) issue exists in the AS2 component. The component accepts a destination address for the asynchronous Message Disposition Notification (MDN) directly from an inbound message without validation. This allows a remote partner to specify the host the Camel instance connects to, potentially enabling access to internal network hosts. If credentials are configured for MDN delivery, they may be transmitted to the attacker-controlled destination.

Recommendations Upgrade to version 4.18.5 for users on the 4.18.x LTS stream. Upgrade to version 4.22.1 for users on the 4.22.x LTS stream. Upgrade to version 4.23.0 for other affected versions. Restrict outbound connectivity from the AS2 receiver to legitimate partner endpoints. Avoid attaching credentials to MDN delivery that are valid for hosts other than authorized partners.