漏洞公告

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Duplicate Advisory: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Duplicate Advisory: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

Duplicate Advisory: nltk: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure

Duplicate Advisory: Security Report: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

Duplicate Advisory: [CWE-1188] Default ENFORCE=False Disables All pathsec Security Controls

Duplicate Advisory: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

Duplicate Advisory: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

YOURLS has stored XSS in referrer statistics chart via crafted Referer header