Andrea Cosentino from Apache Software Foundation

Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction

Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files

Apache Doris: Timing Attack weakness

Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository