Apache Software Foundation Apache Camel vulnerabilities

CVE-2025-27636 [MEDIUM] CWE-178 CVE-2025-27636: Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue a Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is

CVE-2026-33453 [CRITICAL] CWE-915 CVE-2026-33453: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apac Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers (e.g. camel-exec) The camel-coap c

CVE-2026-40860 [CRITICAL] CWE-502 CVE-2026-40860: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, des JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enab

CVE-2026-46454 [CRITICAL] CWE-20 CVE-2026-46454: Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd componen Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel mess

CVE-2026-78165 [HIGH] CWE-502 CVE-2026-78165: Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issu Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the

CVE-2026-48204 [CRITICAL] CWE-20 CVE-2026-48204: Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConsta

CVE-2026-40047 [CRITICAL] CWE-88 CVE-2026-40047: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through th

CVE-2016-8749 [CRITICAL] CWE-502 CVE-2016-8749: Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Executio Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

CVE-2026-46455 [CRITICAL] CWE-613 CVE-2026-46455: Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloa Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initi

CVE-2026-48203 [CRITICAL] CWE-20 CVE-2026-48203: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request,

CVE-2024-23114 [CRITICAL] CWE-502 CVE-2024-23114: Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRep Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.

CVE-2026-66906 [CRITICAL] CWE-23 CVE-2026-66906: Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue af Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into

CVE-2026-83531 [HIGH] CWE-94 CVE-2026-83531: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elemen Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The dynamic-router-control endpoint, introduced in 4.4.

CVE-2026-88900 [HIGH] CWE-502 CVE-2026-88900: Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This iss Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body fr

CVE-2026-43865 [HIGH] CWE-502 CVE-2026-43865: Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-haze Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no user-supplied HazelcastInstance, hazelcastConfigUri, or re

CVE-2026-40859 [HIGH] CWE-502 CVE-2026-40859: Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component des Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is rea

CVE-2017-3159 [CRITICAL] CWE-502 CVE-2017-3159: Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

CVE-2026-80312 [HIGH] CWE-287 CVE-2026-80312: Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated ro

CVE-2017-12634 [CRITICAL] CWE-502 CVE-2017-12634: The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

CVE-2017-12633 [CRITICAL] CWE-502 CVE-2017-12633: The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.