Apache Software Foundation Apache Camel vulnerabilities

CVE-2026-80343 [HIGH] CWE-178 CVE-2026-80343: Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This is Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the reque

CVE-2026-79983 [HIGH] CWE-22 CVE-2026-79983: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the con

CVE-2026-79985 [HIGH] CWE-22 CVE-2026-79985: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the con

CVE-2026-79984 [HIGH] CWE-22 CVE-2026-79984: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating

CVE-2026-80344 [HIGH] CWE-918 CVE-2026-80344: Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address

CVE-2026-88901 [HIGH] CWE-611 CVE-2026-88901: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue a Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files

CVE-2026-42527 [HIGH] CWE-502 CVE-2026-42527: Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter patt Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits

CVE-2026-79986 [HIGH] CWE-22 CVE-2026-79986: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating

CVE-2026-55993 [HIGH] CWE-20 CVE-2026-55993: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (Websoc

CVE-2026-85250 [HIGH] CWE-611 CVE-2026-85250: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults.

CVE-2018-8027 [CRITICAL] CWE-611 CVE-2018-8027: Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor. Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.

CVE-2026-78164 [HIGH] CWE-200 CVE-2026-78164: Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Info Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel HTTP producer families let an inbou

CVE-2026-46457 [HIGH] CWE-20 CVE-2026-46457: Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component ma Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy() with no inbound rules configured (NatsConfiguration). With no inFilter, inFilterPattern or inFilterStartsWith set, D

CVE-2026-85251 [HIGH] CWE-200 CVE-2026-85251: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP compon Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2Client

CVE-2026-66907 [HIGH] CWE-23 CVE-2026-66907: Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affect Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. That option is documen

CVE-2026-46592 [HIGH] CWE-20 CVE-2026-46592: Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE)

CVE-2026-66908 [HIGH] CWE-287 CVE-2026-66908: Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue af Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT keystore properties. JWTAuthenticationConfigurer.buildJwtOp

CVE-2026-40048 [HIGH] CWE-502 CVE-2026-40048: The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effe

CVE-2026-46588 [HIGH] CWE-20 CVE-2026-46588: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

CVE-2026-46587 [HIGH] CWE-20 CVE-2026-46587: Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.