Cyber ·
CVE-2026-95664: untrusted S3 keys evaluated as Simple expressions in Apache Camel
Advisory on the Apache Camel AWS2-S3 component, which may interpret untrusted S3 object keys received in the CamelAwsS3Key header as Simple expressions. Medium severity, CVSS 3.1 score of 5.4.
Advisory CVE-2026-95664, published on 23 October 2026 in the oss-sec feed, describes an issue in the Apache Camel AWS2-S3 producer. According to the text, the component may interpret untrusted S3 object keys received in the CamelAwsS3Key header as Simple expressions. It is classified as improper neutralization of special elements in an expression language statement, known as expression language injection.
The stated severity is CVSS 3.1 of 5.4 (medium), with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The affected versions of the org.apache.camel:camel-aws2-s3 artifact are 4.8.0 before 4.18.5 and 4.19.0 before 4.22.2.
The available text is truncated in the description, so the exploitation path and full conditions cannot be detailed beyond what is quoted here. Consult the original advisory referenced in the oss-sec feed, which carries the CVE identifier and the publication attribution.
Relevance: teams using Apache Camel with S3 to feed data flows, including flows that send content to AI models, should check the component version in their projects and upgrade to a release equal to or later than the fixed versions listed above.