CVE-2026-56140

[CVE catalog]

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.74% · Oct 25, 2026

A flaw was found in the Apache Camel AWS SNS component (`camel-aws2-sns`). An improper input validation vulnerability exists in the `Sns2HeaderFilterStrategy` due to a missing inbound filter rule. However, this component is producer-only, meaning it does not process external messages in a way that would allow an attacker to exploit this flaw. This issue is considered a defense-in-depth hardening change with no known exploit path. org.apache.camel/camel-aws2-sns: Apache Camel AWS SNS Component: Defense-in-depth hardening due to improper input validation A defense-in-depth hardening change was made to the Apache Camel AWS SNS component. The Sns2HeaderFilterStrategy lacked an inbound filter rule. However, camel-aws2-sns is producer-only and does not support consumers, so no externally-supplied message attributes are ever mapped inbound through SNS. This change aligns the SNS header filter strategy with the corrected SQS strategy. There is no known exploit path in camel-aws2-sns. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.