fix(security): suppress camel JWT CVE - #164
Merged
Merged
Conversation
The 2026-08-31 nightly failed its post-update CVE scan. The 7 camel CVEs fixed by 4.18.4 are gone; this is a new finding published since. CVE-2026-66908 (CVSS 7.5) is in the Apache Camel Platform HTTP Main component: the camel-main embedded HTTP server built Vert.x JWTAuth from the keystore alone when neither jwtIssuer nor jwtAudience was set, so inbound tokens were checked only for signature and expiry. See CAMEL-24281. No upgrade clears it on our line. The advisory is explicit: "This behaviour is fixed only on 4.22.0 ... The fail-closed guard could not be backported." 4.18.4 is the newest 4.18.x release. Camel 4.22.0 is not available to us. camel-spring-boot switched to Spring Boot 4 at 4.19.0: 4.19.0 and 4.20.0 resolve Spring Boot 4.0.5, 4.21.0 and 4.22.0 resolve Spring Boot 4.1.0 with Spring Framework 7.0.8. Pinning Spring Boot 3.5.16 underneath camel 4.22.0 resolves cleanly but does not run — camel-spring-boot-4.22.0.jar is compiled against Spring Boot 4 package locations that do not exist in 3.5.16: org.springframework.boot.EnvironmentPostProcessor -> 3.5.16 has org.springframework.boot.env.EnvironmentPostProcessor org.springframework.boot.tomcat.servlet.TomcatServletWebServerFactory -> 3.5.16 has org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory Both ship in the core spring-boot artifact, which is on the classpath at 3.5.16, so these are NoClassDefFoundError at startup, not unresolved optional jars. izgw-core, izgw-hub, izgw-transform and v2tofhir all take this BOM as parent and none declares its own spring-boot.version, so moving off 3.5.x is a coordinated four-repo major upgrade. Suppress with an expiry of 2027-02-28 to put a date on that decision. The vulnerable code is not on the classpath: camel-platform-http-main and io.vertx are absent from both the BOM validation tree and izgw-transform, and camel-main-4.18.4.jar carries no JWT, platform-http or Vert.x classes. Matched on <cve> alone. Per the suppression XSD, <cpe> is a suppress-what element rather than a dependency selector, so keying on cpe:/a:apache:camel would have hidden every camel finding including future ones. Also remove the CVE-2026-54285 opentelemetry entry added in fa8bd73. It never matched: it was keyed on <packageUrl>, but opentelemetry-api ships no META-INF/maven (the Java client builds with Gradle) so Dependency-Check derives no purl for it. Rather than re-key it, let the finding stand. At CVSS 5.3 it is below the --failOnCVSS 7 gate, so it never fails a build; it sets HAS_CVES, which labels the nightly PR "security" and leaves it for a human to merge. That is the intended behaviour of that gate. Verified: xmllint --schema dependency-suppression.1.3.xsd validates. Suppression matching itself is unverified locally — Dependency-Check needs the NVD database and an API key. Confirm with a workflow_dispatch run.
keithboone
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 2026-08-31 nightly failed its post-update CVE scan for Apache Camel.
CVE-2026-66908 (CVSS 7.5) is in the Apache Camel Platform HTTP Main component: the camel-main embedded HTTP server built Vert.x JWTAuth from the keystore alone when neither jwtIssuer nor jwtAudience was set, so inbound tokens were checked only for signature and expiry. See CAMEL-24281.
This is fixed in 4.22.0. We are currently on 4.18.4 which is the latest 4.18.x
The advisory is explicit: "This behaviour is fixed only on 4.22.0 ... The fail-closed guard could not be backported." Basically on the options are back ported.
We can't upgrade (yet) to 4.22.0 because camel-spring-boot changed to Spring Boot 4 starting with 4.19.0 and Transformation Service (which uses Camel) is currently on Spring Boot 3.
There is a backlog spike/ticket being actively worked to upgrade Spring, so for now I wanted to add suppression for these Camel items so that we can get izgw-bom built.
All this said - all our our JWT handling comes from izgw-core and not from Camel. JWTAuthenticationConfigurer (the
vulnerable class) does not exist anywhere in izgw-transform which uses Camel.