{"action":"Upgrade org.apache.camel:camel-knative to 4.14.9 (4.14.x), 4.18.4 (4.18.x) or 4.22.0 (4.22.x) or later.","affected":[{"fixed":"4.14.9","introduced":"3.15.0"},{"fixed":"4.18.4","introduced":"4.15.0"},{"fixed":"4.22.0","introduced":"4.19.0"}],"component":"org.apache.camel:camel-knative","cve_ids":["CVE-2026-63621"],"ecosystem":"Maven","epss":0.00588,"exploited":false,"fixed_versions":["4.14.9","4.18.4","4.22.0"],"ghsa_id":"GHSA-vvwm-3j43-7pfm","id":"tcs_01M5N9EX1603ZYPX9ZS4XQBZCV","modified_at":"2026-08-28T20:55:37.874063Z","published_at":"2026-08-24T18:31:51Z","references":["https://osv.dev/vulnerability/GHSA-vvwm-3j43-7pfm","https://nvd.nist.gov/vuln/detail/CVE-2026-63621","https://github.com/apache/camel/pull/24724","https://github.com/apache/camel/pull/24751","https://github.com/apache/camel/pull/24753","https://github.com/apache/camel/pull/24768","https://github.com/apache/camel/commit/4eb26807d40420abf45253286ce3d07c2fba448c","https://github.com/apache/camel/commit/5c7a8dbf1f1ed92bb4f289a50cc1765095054112","https://github.com/apache/camel/commit/bbf680af8af4a39f808727758e72d469c2eec539","https://camel.apache.org/security/CVE-2026-63621.html","https://github.com/apache/camel","https://github.com/apache/camel/releases/tag/camel-4.14.9","https://github.com/apache/camel/releases/tag/camel-4.18.4","https://github.com/apache/camel/releases/tag/camel-4.22.0","https://issues.apache.org/jira/browse/CAMEL-24084"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-vvwm-3j43-7pfm","url":"https://osv.dev/vulnerability/GHSA-vvwm-3j43-7pfm"}],"summary":"Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy"}