CVE-2026-48205

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Apache Camel DNS component allows for Server-Side Request Forgery (SSRF). The camel-dns producers read DNS operation parameters from Exchange message headers using plain strings: dns.server, dns.name, dns.domain, dns.type, dns.class, and term. Because these do not start with the Camel prefix, the HttpHeaderFilterStrategy allows them to pass from inbound HTTP requests into the Exchange. In routes bridging an HTTP consumer to a dns: producer, an unauthenticated attacker can set the dns.server header to redirect queries to a malicious DNS server to observe queried names or return poisoned responses. Additionally, manipulating dns.name or dns.domain allows for internal network reconnaissance by resolving arbitrary internal hostnames.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. After upgrading, replace the use of dns.* and term header names with CamelDnsServer, CamelDnsName, CamelDnsDomain, CamelDnsType, CamelDnsClass, and CamelDnsTerm in routes driving DNS operations. As a temporary mitigation, strip dns.* and term headers from untrusted ingress before they reach the dns: producer and set DNS parameters from a trusted source within the route.