Loading vulnerability…
CVE-2026-63621 is an improper input-validation vulnerability in Apache Camel's camel-knative component. The Knative consumer maps CloudEvent attributes to Camel Exchange headers. While binary-mode HTTP headers undergo filtering, structured-mode CloudEvents are processed by reading extension fields from the JSON payload and copying them to Exchange headers without a HeaderFilterStrategy. Because Camel header matching is case-insensitive, attacker-controlled extension names can collide with Camel-internal headers. This permits untrusted structured CloudEvents to override header-derived routing, HTTP target, or file-output settings in downstream routes. Affected CloudEvent processor implementations support specification versions 1.0, 1.0.1, and 1.0.2.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains two runnable Java proof-of-concept reproducers for CVE-2026-63621 in Apache Camel camel-knative: a full HTTP-driven Camel Quarkus variant and a Spring Boot variant that directly invokes the vulnerable structured CloudEvent decode path. The exploit capability is header injection via structured-mode CloudEvents: attacker-controlled JSON extension fields are mapped to Camel message headers without HeaderFilterStrategy filtering in affected versions, allowing injection of Camel-internal control headers such as CamelSqlQuery. The Quarkus app exposes /exploit/attack, which sends two POST requests to http://localhost:8080/events with Content-Type application/cloudevents+json; the malicious request includes extension field camelsqlquery carrying a benign SQL marker string. VictimRoute consumes from knative:endpoint/myEndpoint and echoes ${header.CamelSqlQuery}, making successful injection observable. The Spring Boot app exposes /exploit/attack and uses KnativeStructuredConsumer to call CloudEventProcessors.fromSpecVersion("1.0").consumer(null, null) directly, then reads CamelSqlQuery from the Exchange to prove the same issue without the Vert.x knative HTTP transport. Repository structure is clean and educational: top-level README explains the vulnerability, affected/fixed versions, and run instructions; each runtime has its own Dockerfile, docker-compose, pom.xml, README, Java sources, and configuration. This is a real exploit/reproducer rather than a detector: it actively crafts malicious CloudEvent payloads and demonstrates control-header injection, though it stops short of executing SQL and instead proves downstream impact by echoing the injected value.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.