Apache Camel (Apache Software Foundation) - vulnerabilities (CVEs)

96 CVEs, 46 in the last 30 days, 5 known versions, newest CVE from 2026-10-26. Vendor: Apache Software Foundation.

CVEs of Apache Camel

CVE-2026-90885 - CVSS 7.5 (high), 2026-10-26: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-94386 - CVSS 4.8 (medium), 2026-10-26: Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2.…
CVE-2026-95628 - CVSS 5.4 (medium), 2026-10-26: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache…
CVE-2026-95629 - CVSS 5.4 (medium), 2026-10-26: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache…
CVE-2026-95663 - CVSS 4.8 (medium), 2026-10-26: Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0…
CVE-2026-95664 - CVSS 5.4 (medium), 2026-10-26: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3…
CVE-2026-101259 - CVSS 5.3 (medium), 2026-10-26: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-88900 - CVSS 8.8 (high), 2026-10-19: Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from…
CVE-2026-91858 - CVSS 6.5 (medium), 2026-10-19: FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and…
CVE-2026-88901 - CVSS 8.2 (high), 2026-10-19: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0…
CVE-2026-85317 - CVSS 4.8 (medium), 2026-10-19: Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from…
CVE-2026-85316 - CVSS 4.8 (medium), 2026-10-19: Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5,…
CVE-2026-85315 - CVSS 5.3 (medium), 2026-10-19: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-85314 - CVSS 6.5 (medium), 2026-10-19: Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.…
CVE-2026-85313 - CVSS 4.3 (medium), 2026-10-19: Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-85312 - CVSS 4.8 (medium), 2026-10-19: Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.…
CVE-2026-85300 - CVSS 5.5 (medium), 2026-10-19: Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before…
CVE-2026-85301 - CVSS 4.8 (medium), 2026-10-19: Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before…
CVE-2026-85296 - CVSS 6.5 (medium), 2026-10-19: Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0…
CVE-2026-85260 - CVSS 5.5 (medium), 2026-10-19: Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from…
CVE-2026-85257 - CVSS 5.3 (medium), 2026-10-19: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-85254 - CVSS 6.5 (medium), 2026-10-19: Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from…
CVE-2026-85251 - CVSS 7.5 (high), 2026-10-19: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-85250 - CVSS 7.5 (high), 2026-10-19: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-85249 - CVSS 6.5 (medium), 2026-10-19: Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.…
CVE-2026-85248 - CVSS 5.9 (medium), 2026-10-19: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects…
CVE-2026-85247 - CVSS 5.9 (medium), 2026-10-19: Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before…
CVE-2026-85246 - CVSS 5.3 (medium), 2026-10-19: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before…
CVE-2026-85245 - CVSS 5.9 (medium), 2026-10-19: Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from…
CVE-2026-85243 - CVSS 5.9 (medium), 2026-10-19: Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5,…
CVE-2026-84181 - CVSS 5.9 (medium), 2026-10-19: Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.…
CVE-2026-84180 - CVSS 5.3 (medium), 2026-10-19: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0…
CVE-2026-84178 - CVSS 6.1 (medium), 2026-10-19: Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0…
CVE-2026-84176 - CVSS 6.5 (medium), 2026-10-19: Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0…
CVE-2026-83531 - CVSS 8.8 (high), 2026-10-19: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression…
CVE-2026-80344 - CVSS 8.2 (high), 2026-10-19: Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before…
CVE-2026-80343 - CVSS 8.2 (high), 2026-10-19: Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from…
CVE-2026-80312 - CVSS 8.2 (high), 2026-10-19: Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.…
CVE-2026-79986 - CVSS 7.4 (high), 2026-10-19: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache…
CVE-2026-79985 - CVSS 7.4 (high), 2026-10-19: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel:…
CVE-2026-79984 - CVSS 7.4 (high), 2026-10-19: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issue affects Apache…
CVE-2026-79983 - CVSS 7.4 (high), 2026-10-19: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component. This issue affects Apache Camel:…
CVE-2026-78165 - CVSS 8.8 (high), 2026-10-19: Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from…
CVE-2026-78164 - CVSS 8.2 (high), 2026-10-19: Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache…
CVE-2026-78163 - CVSS 5.9 (medium), 2026-10-19: Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an…
CVE-2026-78162 - CVSS 10 (critical), 2026-10-19: Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The…
CVE-2026-78329 - CVSS 9.8 (critical), 2026-08-24: Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before…
CVE-2026-71300 - CVSS 9.8 (critical), 2026-08-24: Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0…
CVE-2026-63621 - CVSS 5.3 (medium), 2026-08-24: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel…
CVE-2026-66908 - CVSS 7.5 (high), 2026-08-24: Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main…
CVE-2026-66907 - CVSS 7.5 (high), 2026-08-24: Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before…
CVE-2026-66906 - CVSS 9.1 (critical), 2026-08-24: Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0…
CVE-2026-60093 - CVSS 5.5 (medium), 2026-08-24: Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0…
CVE-2026-59230 - CVSS 6.5 (medium), 2026-08-24: Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0…
CVE-2026-46588 - CVSS 7.3 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through…
CVE-2026-46587 - CVSS 7.3 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through…
CVE-2026-49042 - CVSS 7.3 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are…
CVE-2026-43866 - CVSS 7.3 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent…
CVE-2026-43867 - CVSS 9.8 (critical), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata)…
CVE-2026-49365 - CVSS 5.3 (medium), 2026-07-06: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer…
CVE-2026-49098 - CVSS 5.3 (medium), 2026-07-06: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel…
CVE-2026-49097 - CVSS 6.5 (medium), 2026-07-06: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel…
CVE-2026-48204 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects…
CVE-2026-48203 - CVSS 9.1 (critical), 2026-07-06: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery…
CVE-2026-46592 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer…
CVE-2026-46591 - CVSS 8.2 (high), 2026-07-06: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher…
CVE-2026-46590 - CVSS 8.8 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata)…
CVE-2026-46457 - CVSS 7.5 (high), 2026-07-06: Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but…
CVE-2026-46456 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel…
CVE-2026-46455 - CVSS 9.8 (critical), 2026-07-06: Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper…
CVE-2026-46454 - CVSS 9.8 (critical), 2026-07-06: Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the…
CVE-2026-46453 - CVSS 5.3 (medium), 2026-07-06: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The…
CVE-2026-43865 - CVSS 8.1 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances…
CVE-2026-42527 - CVSS 8.1 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for…
CVE-2026-40859 - CVSS 8.1 (high), 2026-07-06: Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type…
CVE-2026-40047 - CVSS 9.1 (critical), 2026-07-06: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling…
CVE-2026-47323 - CVSS 9.8 (critical), 2026-05-19: Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations…
CVE-2026-33453 - CVSS 10 (critical), 2026-04-27: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap…
CVE-2026-27172 - CVSS 8.8 (high), 2026-04-27: The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)…
CVE-2026-40858 - CVSS 8.8 (high), 2026-04-27: The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using…
CVE-2026-33454 - CVSS 9.4 (critical), 2026-04-27: The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy)…
CVE-2026-40860 - CVSS 9.8 (critical), 2026-04-27: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values…
CVE-2026-23552 - CVSS 9.1 (critical), 2026-02-23: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate…
CVE-2025-30177 - CVSS 6.5 (medium), 2025-04-01: Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before…
CVE-2025-29891 - CVSS 4.8 (medium), 2025-03-12: Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before…
CVE-2025-27636 - CVSS 5.6 (medium), 2025-03-09: Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from…
CVE-2024-22371 - CVSS 7.5 (high), 2024-02-26: Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in…
CVE-2024-23114 - CVSS 9.8 (critical), 2024-02-20: Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization.…
CVE-2024-22369 - CVSS 7.8 (high), 2024-02-20: Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before…
CVE-2018-8041 - CVSS 5.3 (medium), 2018-09-17: Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
CVE-2018-8027 - CVSS 9.8 (critical), 2018-07-31: Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
CVE-2017-12634 - CVSS 9.8 (critical), 2017-11-15: The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.…
CVE-2017-12633 - CVSS 9.8 (critical), 2017-11-15: The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.…
CVE-2016-8749 - CVSS 9.8 (critical), 2017-03-28: Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
CVE-2017-5643 - CVSS 7.4 (high), 2017-03-16: Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
CVE-2017-3159 - CVSS 9.8 (critical), 2017-03-07: Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.