Skip to content

P6 Core 6.10.26

Release date: TBD

Documentation can be found here.

TL;DR

This release continues the security library clean-up started in 6.10.25 (“Sec Library upgrade / Sync” initiative). The BouncyCastle cryptography libraries used by the OpenPGP, AS2 (S/MIME), PDF-signing and FTPS features move from 1.78.1 to the 1.85 line, clearing the CVEs reported on 1.78.1; existing certificates, keys and key stores keep working, and the AS2 signature verification was adapted so that partner certificates with a non-standard issuer name (Common Name longer than 64 characters, non two-letter country code) remain accepted. The RabbitMQ Java client behind the spring-rabbitmq route component moves to a CVE-free version whose TLS connections now validate the broker certificate and host name, which routes connecting to brokers with self-signed certificates must take into account. This release continues the security library clean-up started in 6.10.25. The Apache Ivy jar that was still shipped for Groovy @Grab support has been removed: @Grab has been prohibited in scripts and routes since 6.9.9, so the jar was dead weight carrying a known CVE. This release continues the security library clean-up started in 6.10.25 and repairs explicit FTPS on the embedded FTP server, which had been rejecting AUTH TLS since the FTP server library upgrade of March 2026. Apache HttpClient 5, the client behind the http and https route components, moves to a CVE-free version; routes that follow a redirect to another host while setting their own Authorization or Cookie header no longer have that redirect followed, so the credential is never disclosed to the second server. Apache Camel, the engine behind the Routes service, moves from the 4.12 line to the 4.18 LTS line together with a Quartz and Groovy alignment, clearing the three CVEs reported on the camel-mail component. Route deployment scripts and the Platform 6 Camel components are unchanged; a handful of Camel defaults changed for application routes (mail headers, pollEnrich limits, JSON polymorphic typing, header filtering, shared unit of work) and are listed in the migration troubleshooting page. Spring Framework then moves to 7.0.9, carrying Apache Camel to 4.22.1 and Spring AMQP to 4.1.1, since each of the three requires the next. This closes the last Spring findings, which have no fix on the 6.2 line now that its OSS support has ended. Application scripts and the Platform 6 DSL are unchanged; RabbitMQ routes are the ones to look at, because queues declared automatically are now durable, the request/reply timeout default moves from 5 to 30 seconds, and scripts building their own retry objects must move to the retry support built into Spring Framework 7.

FTP server

git push –set-upstream origin feature/STN-31236-camel

Removals & Security

  • Upgraded Apache HttpClient 5 to 5.6.4 — the HTTP client behind the http and https route components moves from 5.3.1 to 5.6.4, and httpcore5 / httpcore5-h2 are pinned to 5.4.3 as the line it requires. This clears CVE-2026-71290 (hostname verification policy ineffective in the async client, critical) and, on httpcore5, CVE-2026-54399 and CVE-2026-54428. No p6core API change: HttpClient 5 is shipped for the http route components and for scripts, and p6core’s own HTTP code is on the separate HttpClient 4.5 line. Breaking change for routes that follow redirects: a redirect to a different origin is no longer followed when the route sets an Authorization, Cookie or Proxy-Authorization header itself, so an endpoint with followRedirects=true now fails with an HttpOperationFailedException carrying the redirect status and redirectLocation instead of returning the target response; same-origin redirects and requests without such a header are unchanged. The x509HostnameVerifier option of the http component is not affected, because that component builds its TLS layer with SSLConnectionSocketFactory, which still applies a custom verifier; only scripts building their own client with DefaultClientTlsStrategy inherit the new HostnameVerificationPolicy.BUILTIN default. New unit tests cover the camel-http producer, both redirect cases and the TLS entry points. See the migration troubleshooting page. (STN-31231)
  • Upgraded BouncyCastle to 1.85 (bcprov 1.85.2) — The bcprov, bcpkix, bcutil, bcpg and bcjmail jdk18on artifacts are upgraded from 1.78.1 to 1.85 as a consistent set (bcprov on 1.85.2, which fixes the provider start-up and PKCS#12 regressions of 1.85). This clears the CVEs reported on the 1.78.1 line, including CVE-2025-14813 (GOST CTR, critical), CVE-2026-8763 (name-constraints bypass), CVE-2026-12817 (OpenPGP AEAD), CVE-2026-12860 (RSA PKCS#1 verification) and the CVE-2026-59638 to CVE-2026-59652 series (OpenPGP, CMS, KDF denial of service). No p6core API change. BouncyCastle 1.85 validates X.500 names it builds strictly; the AS2 signature verification no longer rebuilds the issuer name from its string form, so existing partner certificates are unaffected. New unit tests cover the OpenPGP, S/MIME, PDF-signing and FTPS code paths, including that case. (STN-31233)
  • The RabbitMQ Java client (com.rabbitmq:amqp-client) used by the spring-rabbitmq route component is pinned from 5.22.0 to 5.35.0, clearing CVE-2026-69219 and CVE-2026-69220 (pre-authentication frame parsing denial of service) as well as CVE-2026-61634, CVE-2026-63335, CVE-2026-63336 and CVE-2026-63337. The Netty transport the client optionally supports is excluded, so no new jar ships. Breaking change: connections over TLS now validate the broker certificate against the JVM trust store and verify the broker host name, where the client previously trusted any certificate. Routes connecting to a broker with a self-signed certificate must either trust the certificate through a trust store passed with useSslProtocol(sslContext), or call useTlsWithNoVerification() on the client connection factory for non-production brokers; in both cases the certificate must carry the broker host name. Spring AMQP’s setSkipServerCertificateValidation(true) no longer skips the validation. See the RabbitMQ component documentation for examples. (STN-31227)
  • The unused org.apache.ivy:ivy 2.5.2 jar has been removed from the lib/ folder of the distribution, together with the empty conf/grape working folder and the -Dgrape.root JVM property of the Docker start script. Groovy Grape dependency resolution (@Grab, @Grapes, Grape.grab) has been disabled in scripts modules and route deployment scripts since 6.9.9, so Ivy could never be loaded; new sandbox unit tests now document that rejection. This clears CVE-2026-26032 (path traversal in the Ivy PackagerResolver) from dependency scanning. No behaviour changes and no migration step. (STN-31223)
  • org.apache.mina:mina-core, the network layer of the embedded FTP server, is pinned from 2.2.4 to 2.2.9. This clears CVE-2026-41409, CVE-2026-41635, CVE-2026-42778, CVE-2026-42779, CVE-2026-47065 and CVE-2026-47321 from dependency scanning. Platform 6 never used the affected deserialisation and compression filters, so there is no behaviour change; since MINA 2.2.5 the TLS handshake tasks run inline instead of on a separate executor, which the new FTPS test covers. (STN-31224)
  • Upgraded Apache Camel 4.12.0 to 4.18.4 (LTS) — all 15 bundled camel-* artifacts move together (single camel.version), Quartz aligns from 2.4.0 to 2.5.2 and Groovy from 4.0.15 to 4.0.30 on Camel’s baseline. This clears CVE-2026-33454 (camel-mail MIME header injection, high), CVE-2026-46584 (camel-mail mail.smtp.* session properties taken from message headers) and CVE-2026-59230 (camel-mail MIME multipart header filtering). No p6core API change; the p6rest, p6ftpd, p6sftpd components, the route compiler and the bundled file, http, quartz and jackson components are now covered by unit tests. Breaking change for application routes using the mail component: the per-message headers copyTo, moveTo and delete are renamed CamelMailCopyTo, CamelMailMoveTo and CamelMailDelete, and mail.smtp.* headers only reach the SMTP session when the endpoint sets useJavaMailSessionPropertiesFromHeaders=true. The other changed defaults (pollEnrich eager limit, camel-jackson BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES, lower-cased header filtering, shared unit of work in split/multicast, validate() without end(), simple language operator spellings) are detailed in the migration troubleshooting page. (STN-31236)
  • Upgraded Spring Framework to 7.0.9, Apache Camel to 4.22.1 (LTS) and Spring AMQP to 4.1.1 — the three move together because each one requires the next: Spring AMQP 4 requires Spring Framework 7, and Camel 4.19 dropped Spring Framework 6. Kotlin’s runtime jars follow to 2.2.21, the Spring 7 baseline. This clears CVE-2026-47886 and CVE-2026-59283 (SpEL), which have no fix on the 6.2 line now that its OSS support has ended, and CVE-2026-47860 (unbounded decompression) on spring-amqp / spring-rabbit. The spring-jcl module was removed upstream and its exclusion is gone with it; Spring’s logging still reaches log4j2 through jcl-over-slf4j, and a new unit test pins that routing. spring-retry leaves the distribution entirely, because Spring AMQP 4 replaces it with the retry support built into Spring Framework 7. No p6core API change and no source change was needed. Breaking change for application routes: RabbitMQ queues declared by autoDeclare are now durable and the request/reply replyTimeout default moves from 5 to 30 seconds; the file and FTP option preSort is no longer a boolean but names the field to sort on, and the producer option forceWrites now defaults to false; scripts building a RetryTemplate or RetryPolicy for a RabbitMQ route must move from org.springframework.retry to org.springframework.core.retry, where maxAttempts(3) becomes maxRetries(2). The connection factory wiring published in the RabbitMQ component documentation is unchanged. These and the remaining Camel 4.19 to 4.22 default changes are detailed in the migration troubleshooting page. (STN-31239)