CVE-2026-49042
published 2026-07-06CVE-2026-49042: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are…
PriorityP346high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.69%
52.4th percentile
Improper Input Validation vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0.
Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | >= 4.19.0 < 4.21.0 | 4.21.0 |
| apache | camel | >= 4.8.0 < 4.18.3 | 4.18.3 |
| apache_software_foundation | apache_camel | 4.19.0 – 4.20.0 | — |
| apache_software_foundation | apache_camel | 4.8.0 – 4.18.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters
ghsa·2026-07-06
CVE-2026-49042 [HIGH] CWE-20 Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters
Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters
Improper Input Validation vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0.
Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.
GHSA
Improper Input Validation vulnerability in Apache Camel.
ghsa_unreviewed·2026-07-06
CVE-2026-49042 [HIGH] CWE-20 Improper Input Validation vulnerability in Apache Camel.
Improper Input Validation vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0.
Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-06
Published