McEliece claim, kernel TAP DoS, Camel and gzip CVEs

A claimed quasipolynomial break of Classic McEliece drew technical pushback on the NIST PQC list, while oss-security carried a guest-to-host Linux TAP panic and a cluster of moderate Apache Camel flaws plus a gzip out-of-bounds fix. The Camel reports span header injection, skipped JWT claim checks, and path traversal in Azure storage components.

Claimed quasipolynomial attack on Classic McEliece

A paper presented on the NIST PQC forum asserts a quasipolynomial distinguisher and decryption attack against Classic McEliece. Forum analysis concludes the method remains slower than standard attacks already known against the scheme. Post-quantum implementers tracking McEliece security margins can treat the claim as non-improving for now.

Linux kernel guest-to-host DoS via TAP

The Linux kernel tap driver allows a guest-to-host denial of service that panics the host, tracked as CVE-2026-74684. The flaw follows an incomplete earlier fix. Operators running virtualized guests on Linux should apply the corrected patch to stop guests from crashing the host.

Apache Camel MimeMultipart header injection

Apache Camel published CVE-2026-59230 for the camel-mail MimeMultipart data format. When unmarshalling with headersInline enabled, MIME headers were copied onto the Camel message without a header filter strategy. Mail-processing routes that enable that option face a header-injection risk until updated.

Gzip 1.14 out-of-bounds buffer access

Gzip 1.14 contains CVE-2026-41992, an out-of-bounds memory buffer access triggered when decompressing LZW data followed by LZH data. The disclosure on oss-security includes a patch. Hosts that feed untrusted compressed streams to gzip should upgrade.

Apache Camel JWT iss and aud checks skipped

CVE-2026-66908 affects camel-platform-http-main JWT authentication. When a keystore was configured without issuer or audience settings, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted. Services that rely on those claims for authorization need the corrected release.

Path traversal in Camel Azure Storage Blob

CVE-2026-66906 covers the downloadBlobToFile operation in Camel-Azure-Storage-Blob. The local download path was built from the remote blob name without confining it to the configured fileDir. The moderate path-traversal issue can write files outside the intended directory.

Header injection in Camel Knative CloudEvents

CVE-2026-63621 was disclosed for Apache Camel Knative. CloudEvent extension fields arriving in structured content mode were mapped onto message headers without a header filter strategy. Integrations using that mode are exposed to header injection until patched.

Path traversal in Camel Azure DataLake

CVE-2026-60093 affects the downloadToFile operation in Camel-Azure-Storage-DataLake. The local target path was derived from the remote path name without restriction to the configured fileDir. Like the related blob flaw, it permits moderate path traversal outside the intended directory.