Severity:
CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-as2) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-as2) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-as2) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-as2) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-as2) 4.23.0 unaffected
Description:
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2
component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
Signing material belonging to an individual request was stored in state that is
shared across requests rather than confined to the request being processed.
Where a deployment serves more than one trading partner, concurrent or
successive requests could therefore observe each other's material, and a
Message Disposition Notification could be signed with the key of a partner
other than the one the receipt was for. The result is cross-partner key
confusion: a receipt attributable to the wrong partner, and one partner's
signing material used while handling another partner's exchange. AS2
deployments are typically multi-partner by design, so the condition is reached
by ordinary concurrent traffic rather than by anything the attacker must
arrange.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. Per-request signing keys are now confined to
the request being processed in ResponseMDN. For deployments that cannot upgrade
immediately, run a separate Camel context per trading partner so that no
signing material is shared between them.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. Per-request signing keys are now confined to
the request being processed in ResponseMDN.
Work Arounds:
For deployments that cannot upgrade immediately, run a separate Camel context
per trading partner so that no signing material is shared between them.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-85296.html
https://issues.apache.org/jira/browse/CAMEL-24429
https://github.com/apache/camel/pull/25641
https://github.com/apache/camel/pull/25869
https://github.com/apache/camel/pull/25870
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-85296
