Apache Camel vulnerabilities

CVE-2026-46588 [HIGH] CWE-20 CVE-2026-46588: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

CVE-2026-46587 [HIGH] CWE-20 CVE-2026-46587: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

CVE-2020-11994 [HIGH] CWE-74 CVE-2020-11994: Server-Side Template Injection and arbitrary file disclosure on Camel templating components Server-Side Template Injection and arbitrary file disclosure on Camel templating components

CVE-2026-49042 [HIGH] CWE-20 CVE-2026-49042: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8. Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

CVE-2026-49097 [MEDIUM] CWE-20 CVE-2026-49097: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstrea Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header (the constant IrcConstants.IRC_SEND_TO, value irc.sendTo); when that h

CVE-2024-22371 [HIGH] CWE-922 CVE-2024-22371: Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCr Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version

CVE-2017-5643 [HIGH] CWE-918 CVE-2017-5643: Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

CVE-2026-49086 [MEDIUM] CWE-20 CVE-2026-49086: Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two

CVE-2024-22369 [HIGH] CWE-502 CVE-2024-22369: Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apac Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are sugg

CVE-2026-59230 [MEDIUM] CWE-20 CVE-2026-59230: Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2. Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured with headersInline set to true, the unmarshal path cop

CVE-2015-0263 [MEDIUM] CVE-2015-0263: XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.ja XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.

CVE-2025-30177 [MEDIUM] CWE-164 CVE-2025-30177: Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditio Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injec

CVE-2015-0264 [MEDIUM] CVE-2015-0264: Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.

CVE-2018-8041 [MEDIUM] CWE-22 CVE-2018-8041: Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path tr Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.

CVE-2026-49098 [MEDIUM] CWE-20 CVE-2026-49098: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstrea Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kafka Component. The camel-kafka producer can override its configured target topic at runtime from the kafka.OVERRIDE_TOPIC Exchange header: KafkaProducer.evaluateTopic() returns the header value

CVE-2026-63621 [MEDIUM] CVE-2026-63621: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstrea Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through

CVE-2026-48206 [MEDIUM] CWE-20 CVE-2026-48206: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their operation parameters - the issue key, project key, transition id, summary, type, assignee, components, watchers, link type, work-log minutes and others - from Exchange message headers. The heade

CVE-2026-49099 [MEDIUM] CWE-74 CVE-2026-49099: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search, the target SObject name and id, the Apex REST URL an

CVE-2026-56139 [MEDIUM] CWE-209 CVE-2026-56139: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false, whereas the other Camel HTTP server components (camel-

CVE-2026-49365 [MEDIUM] CWE-209 CVE-2026-49365: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTT Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false because the backing field was an uninitialised pri