Andrea Cosentino

**Name of the Vulnerable Software and Affected Versions** Apache Fluss versions prior to 0.9.1 **Description** The Netty LengthFieldBasedFrameDecoder is configured with `Integer.MAX VALUE` as the maximum frame length. This allows unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, leading to a denial of service. **Recommendations** Upgrade to version 0.9.1.

**Name of the Vulnerable Software and Affected Versions** Apache Flink Kubernetes Operator versions 1.3.0 through 1.14.x **Description** A Server-Side Request Forgery (SSRF) and local file access issue exists where the `jarURI` in `FlinkSessionJob` is not validated. This allows a user with CR create permissions to read files from the operator pod's filesystem and retrieve content from any backing store reachable via Flink's pluggable filesystem layer. For http/https addresses, there is no URI scheme allowlist, host check, IP-range restriction, or protection against internal or link-local addresses. **Recommendations** Upgrade to version 1.15.0.

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1 **Description** The Camel-PQC `FileBasedKeyLifecycleManager` class deserializes the contents of `<keyId>.key` files in the configured key directory using `java.io.ObjectInputStream` without applying an `ObjectInputFilter` or class-loading restrictions. Because the cast to `java.security.KeyPair` occurs only after the `readObject()` function has returned, any side effects within the deserialized object are executed before the type check. An attacker with write access to the key directory—potentially achieved via path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—can place a crafted serialized Java object to achieve arbitrary code execution within the application context. **Recommendations** Upgrade to version 4.20.0. Upgrade to version 4.18.2 for users on the 4.18.x LTS releases stream.

**Name of the Vulnerable Software and Affected Versions** Apache SkyWalking MCP version 0.1.0 **Description** Server-Side Request Forgery occurs via the 'SW-URL' header. **Recommendations** Upgrade to version 0.2.0.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.15.0 through 4.17.9 **Description** The Camel-Keycloak KeycloakSecurityPolicy does not validate the `iss` (issuer) claim of JWT tokens against the configured realm. This allows a token issued by one Keycloak realm to be silently accepted by a policy configured for a different realm, which breaks tenant isolation. The `iss` claim identifies the issuer of the JWT. **Recommendations** Upgrade to version 4.18.0 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.10.0 through 4.10.7 Apache Camel versions 4.14.0 through 4.14.4 Apache Camel versions 4.15.0 through 4.17.9 **Description** The Apache Camel LevelDB component contains a flaw related to the deserialization of untrusted data. The `DefaultLevelDBSerializer` class deserializes data from the LevelDB aggregation repository using `java.io.ObjectInputStream` without implementing appropriate safeguards like `ObjectInputFilter` or class-loading restrictions. This allows an attacker who can write to the LevelDB database files used by a Camel application to inject a malicious serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitrary code execution within the application's context. The component `LevelDB` uses the function `DefaultLevelDBSerializer` to deserialize data. The vulnerable parameter is the serialized Java object written to the LevelDB database. **Recommendations** Upgrade to Apache Camel version 4.18.0 or later. Upgrade to Apache Camel version 4.10.9 for the 4.10.x LTS releases. Upgrade to Apache Camel version 4.14.5 for the 4.14.x LTS releases.

**Name of the Vulnerable Software and Affected Versions** Apache Hive versions prior to 4.0.0 **Description** The issue arises from the use of `Arrays.equals()` in `LlapSignerImpl` to compare message signatures, allowing an attacker to forge a valid signature for an arbitrary message byte by byte. This can occur when an application does not use a constant-time algorithm for validating a signature. The `Arrays.equals()` method returns false as soon as it encounters different bytes in the input, making the comparison time dependent on the array contents. This could enable malicious users to submit splits or work with selected signatures to LLAP without running as a privileged user, potentially leading to a DDoS attack. The attacker must be an authorized user of the product to perform this attack. **Recommendations** Apache Hive versions prior to 4.0.0: Upgrade to version 4.0.0, which fixes this issue.

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions prior to 3.4.0 Description: The issue is related to the `RunJar.run()` function in Apache Hadoop, which does not set permissions for the temporary directory by default. This allows other local users to view sensitive data written to this directory, as the system temporary directory is shared among all local users on unix-like systems. Recommendations: For Apache Hadoop versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue. As a temporary workaround, consider setting the correct posix permissions explicitly for the temporary directory to prevent unauthorized access. Restrict access to sensitive data written to the temporary directory until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Hive versions prior to 4.0.1 **Description** The issue arises when Hive creates a credentials file in a temporary directory with default permissions of 644, allowing any unauthorized user with access to the directory to read sensitive information. **Recommendations** Hive versions prior to 4.0.1 should be upgraded to version 4.0.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Doris versions prior to 2.0.0 Apache Doris version 1.2.8 and earlier **Description** The authentication method in Apache Doris was vulnerable to timing attacks. This issue allows attackers to potentially exploit the system. Users are recommended to upgrade to a fixed version to resolve this issue. **Recommendations** For Apache Doris versions prior to 2.0.0, upgrade to version 2.0.0 or later. For Apache Doris version 1.2.8 and earlier, upgrade to version 1.2.8 or later.

Name of the Vulnerable Software and Affected Versions: Apache Camel versions 3.0.0 through 3.21.3 Apache Camel versions 3.22.0 through 3.22.0 Apache Camel versions 4.0.0 through 4.0.3 Apache Camel versions 4.1.0 through 4.3.x Description: The issue is related to the deserialization of untrusted data in the Apache Camel CassandraQL Component AggregationRepository, which is vulnerable to unsafe deserialization. Under specific conditions, it is possible to deserialize a malicious payload, potentially allowing a remote attacker to execute arbitrary code. Recommendations: For Apache Camel versions 3.0.0 through 3.21.3, upgrade to version 3.21.4. For Apache Camel versions 3.22.0, upgrade to version 3.22.1. For Apache Camel versions 4.0.0 through 4.0.3, upgrade to version 4.0.4. For Apache Camel versions 4.1.0 through 4.3.x, upgrade to version 4.4.0.

**Name of the Vulnerable Software and Affected Versions** Apache Storm (affected versions not specified) **Description** The issue is related to insufficient access control in the Apache Storm platform for distributed stream computing on UNIX-like systems. This can lead to information disclosure when writing to the temporary directory using APIs that do not explicitly set file or directory permissions. The method `File.createTempFile` creates a file with predefined name and default permissions `-rw-r--r--`, allowing other local users to read sensitive information written to this file. The impact is limited as the affected class is used only when `ui.disable.spout.lag.monitoring` is set to false, which is true by default, and the temporary file is deleted soon after creation. **Recommendations** To resolve the issue, use `Files.createTempFile` instead of `File.createTempFile` to create temporary files with explicit permissions. As a temporary workaround, consider restricting access to the temporary directory until the issue is resolved. We recommend that all users upgrade to the latest version of Apache Storm.

**Name of the Vulnerable Software and Affected Versions** Apache Flink Stateful Functions versions 3.1.0 through 3.2.0 **Description** The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. **Recommendations** For Apache Flink Stateful Functions versions 3.1.0 through 3.2.0, users should upgrade to Apache Flink Stateful Functions version 3.3.0.