Camel (Apache) - vulnerabilities (CVEs)

87 CVEs, 1 in the last 30 days, 312 known versions, newest CVE from 2026-10-26. Vendor: Apache.

CVEs of Camel

CVE-2026-95664 - CVSS 5.4 (medium), 2026-10-26: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3…
CVE-2026-80354 - CVSS 8.1 (high), 2026-09-10: Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant…
CVE-2026-80351 - CVSS 9.8 (critical), 2026-09-10: Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of…
CVE-2026-80352 - CVSS 9.8 (critical), 2026-09-10: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration…
CVE-2026-78329 - CVSS 9.8 (critical), 2026-08-24: Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before…
CVE-2026-71300 - CVSS 9.8 (critical), 2026-08-24: Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0…
CVE-2026-63621 - CVSS 5.3 (medium), 2026-08-24: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel…
CVE-2026-66908 - CVSS 7.5 (high), 2026-08-24: Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main…
CVE-2026-66907 - CVSS 7.5 (high), 2026-08-24: Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before…
CVE-2026-66906 - CVSS 9.1 (critical), 2026-08-24: Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0…
CVE-2026-60093 - CVSS 5.5 (medium), 2026-08-24: Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0…
CVE-2026-59230 - CVSS 6.5 (medium), 2026-08-24: Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0…
CVE-2026-46588 - CVSS 7.3 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through…
CVE-2026-46587 - CVSS 7.3 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through…
CVE-2026-49042 - CVSS 7.3 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are…
CVE-2026-43866 - CVSS 7.3 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent…
CVE-2026-43867 - CVSS 9.8 (critical), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata)…
CVE-2026-56140 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific…
CVE-2026-56139 - CVSS 5.3 (medium), 2026-07-06: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes…
CVE-2026-55994 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in…
CVE-2026-55993 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in…
CVE-2026-53913 - CVSS 9.8 (critical), 2026-07-06: Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.…
CVE-2026-49365 - CVSS 5.3 (medium), 2026-07-06: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer…
CVE-2026-49099 - CVSS 5.3 (medium), 2026-07-06: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key…
CVE-2026-49098 - CVSS 5.3 (medium), 2026-07-06: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel…
CVE-2026-49097 - CVSS 6.5 (medium), 2026-07-06: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel…
CVE-2026-49086 - CVSS 6.5 (medium), 2026-07-06: Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub…
CVE-2026-48206 - CVSS 5.3 (medium), 2026-07-06: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their…
CVE-2026-48205 - CVSS 9.1 (critical), 2026-07-06: Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation…
CVE-2026-48204 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects…
CVE-2026-48203 - CVSS 9.1 (critical), 2026-07-06: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery…
CVE-2026-46726 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in…
CVE-2026-46592 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer…
CVE-2026-46591 - CVSS 8.2 (high), 2026-07-06: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher…
CVE-2026-46590 - CVSS 8.8 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata)…
CVE-2026-46585 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads…
CVE-2026-46584 - CVSS 3.7 (low), 2026-07-06: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer…
CVE-2026-46457 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but…
CVE-2026-46456 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel…
CVE-2026-46455 - CVSS 9.8 (critical), 2026-07-06: Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper…
CVE-2026-46454 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the…
CVE-2026-46453 - CVSS 5.3 (medium), 2026-07-06: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The…
CVE-2026-43865 - CVSS 8.1 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances…
CVE-2026-42527 - CVSS 8.1 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for…
CVE-2026-40859 - CVSS 8.1 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type…
CVE-2026-40047 - CVSS 9.1 (critical), 2026-07-06: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling…
CVE-2026-47323 - CVSS 9.8 (critical), 2026-05-19: Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations…
CVE-2026-27172 - CVSS 8.8 (high), 2026-04-27: The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)…
CVE-2026-33453 - CVSS 10 (critical), 2026-04-27: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap…
CVE-2026-40858 - CVSS 8.8 (high), 2026-04-27: The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using…
CVE-2026-40022 - CVSS 8.2 (high), 2026-04-27: When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path…
CVE-2026-33454 - CVSS 9.4 (critical), 2026-04-27: The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy)…
CVE-2026-40453 - CVSS 9.9 (critical), 2026-04-27: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are…
CVE-2026-40048 - CVSS 7.8 (high), 2026-04-27: The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using…
CVE-2026-40860 - CVSS 9.8 (critical), 2026-04-27: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values…
CVE-2026-40473 - CVSS 8.8 (high), 2026-04-27: The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any…
CVE-2026-25747 - CVSS 8.8 (high), 2026-02-23: Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read…
CVE-2026-23552 - CVSS 9.1 (critical), 2026-02-23: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate…
CVE-2025-66169 - CVSS 5.3 (medium), 2026-01-14: Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3,…
CVE-2025-30177 - CVSS 6.5 (medium), 2025-04-01: Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before…
CVE-2025-29891 - CVSS 4.8 (medium), 2025-03-12: Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before…
CVE-2025-27636 - CVSS 5.6 (medium), 2025-03-09: Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from…
CVE-2024-22371 - CVSS 7.5 (high), 2024-02-26: Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in…
CVE-2024-22369 - CVSS 7.8 (high), 2024-02-20: Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before…
CVE-2024-23114 - CVSS 9.8 (critical), 2024-02-20: Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization.…
CVE-2023-34442 - CVSS 3.3 (low), 2023-07-10: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X…
CVE-2020-11994 - CVSS 7.5 (high), 2020-07-08: Server-Side Template Injection and arbitrary file disclosure on Camel templating components
CVE-2020-11973 - CVSS 9.8 (critical), 2020-05-14: Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…
CVE-2020-11972 - CVSS 9.8 (critical), 2020-05-14: Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…
CVE-2020-11971 - CVSS 7.5 (high), 2020-05-14: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
CVE-2020-5529 - CVSS 8.1 (high), 2020-02-11: HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute…
CVE-2019-0188 - CVSS 7.5 (high), 2019-05-28: Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library.…
CVE-2019-0194 - CVSS 7.5 (high), 2019-04-30: Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier)…
CVE-2018-8041 - CVSS 5.3 (medium), 2018-09-17: Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
CVE-2018-8027 - CVSS 9.8 (critical), 2018-07-31: Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
CVE-2017-12634 - CVSS 9.8 (critical), 2017-11-15: The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.…
CVE-2017-12633 - CVSS 9.8 (critical), 2017-11-15: The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.…
CVE-2016-8749 - CVSS 9.8 (critical), 2017-03-28: Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
CVE-2017-5643 - CVSS 7.4 (high), 2017-03-16: Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
CVE-2017-3159 - CVSS 9.8 (critical), 2017-03-07: Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
CVE-2015-5348 - CVSS 8.1 (high), 2016-04-15: Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel…
CVE-2015-5344 - CVSS 9.8 (critical), 2016-02-03: The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted…
CVE-2015-0264 - CVSS 5 (medium), 2015-06-03: Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote…
CVE-2015-0263 - CVSS 5 (medium), 2015-06-03: XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2…
CVE-2014-0003 - CVSS 7.5 (high), 2014-03-21: The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java…
CVE-2014-0002 - CVSS 7.5 (high), 2014-03-21: The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified…
CVE-2013-4330 - CVSS 6.8 (medium), 2013-10-04: Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by…