Camel CVEs, AI signature audits, and oss-security load

Apache Camel shipped fixes for dozens of CVEs while oss-security debated how to handle a surge of AI-driven vulnerability reports. Separate posts covered claimed practical attacks on academic signature schemes and a code-execution flaw in a Perl JSON query library.

Apache Camel fixes 38 CVEs in three branches

Apache Camel released versions 4.18.5, 4.22.1 and 4.23.0 that address 38 CVEs. The set includes an incomplete earlier deserialization fix and server-side request forgery issues. Operators of the integration framework have a large batch of patches to apply across supported branches.

AI audit reports 20 practical attacks on ePrint signatures

A message to the pqc-forum described an AI-driven audit of signature schemes published on ePrint that has so far produced 20 practical attacks. The schemes in question are obscure academic constructions. Researchers tracking post-quantum signatures may wish to examine the claimed breaks against the original papers.

oss-security declines split list for AI vuln reports

Participants on oss-security discussed a proposal to create a separate mailing list for vulnerability reports in response to volume attributed to AI tools. The moderator opposed the split and instead recommended grouping related reports and using digests. List traffic continues to rise from automated analysis.

JQ::Lite executes Perl code via query regex eval

CVE-2026-78497 covers JQ::Lite versions before 2.51 for Perl. The library compiles regular expressions that appear in queries with string eval, allowing embedded Perl code to run. Users of the module face arbitrary code execution when processing untrusted queries and should move to the fixed release.