Sensitive Information Disclosure

Apache Camel Netty HTTP component is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of exception responses, where processing errors return full Java stack traces instead of suppressing them, allowing attackers to obtain sensitive information such as...

Server-Side Request Forgery (SSRF)

Apache Camel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to unfiltered WebSocket query parameters being mapped to Camel control headers, which allows an attacker to redirect server-side HTTP requests to arbitrary destinations and potentially disclose environment...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of user-supplied input, which allows an attacker to provide crafted input that can be processed in an unintended manner and potentially compromise application behavior...

Server-Side Request Forgery (SSRF)

Apache Camel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper filtering of inbound WebSocket query and path parameters, allowing an attacker to inject Camel control headers such as CamelHttpUri, which can redirect server-side HTTP requests to...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Dapr Pub/Sub consumer copying attacker-controlled CloudEvent fields into producer routing headers, which allows an attacker with permission to publish to the subscribed topic to manipulate the destination and...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of user-supplied input, allowing specially crafted input to bypass expected processing logic and potentially affect application behavior or security...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Iggy consumer copying externally controlled message headers directly into the Camel Exchange without filtering Camel control headers, which allows an attacker who can publish messages to a consumed Iggy...

Improper Input Validation

Apache Camel AWS SNS component is vulnerable to Improper Input Validation. The vulnerability is due to the absence of an inbound header-filtering rule in Sns2HeaderFilterStrategy, which could theoretically allow externally supplied message attributes to be mapped into Camel control headers;...

Improper Input Validation

Apache Camel IRC component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of IRC control headers, where attacker-controlled irc. headers from untrusted HTTP requests can override the intended message destination, allowing unauthorized message...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper deserialization of a crafted JMS ObjectMessage containing an allowed DefaultExchangeHolder object, which bypasses the CVE-2026-40860 class check and allows an attacker who can publish messages to...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to an overly permissive ObjectInputFilter that allows classes such as java.net.URL and java.net.InetAddress during deserialization, which allows an attacker to deliver a crafted Java-serialized payload...

CVE-2026-48206 — Updated!

CVE-2026-48206 — camel-jira IssueKey Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CVE-2026-49098 — Updated!

CVE-2026-49098 — camel-kafka kafka.OVERRIDETOPIC Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus...

CVE-2026-49365 — Updated!

CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Components shown ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

CVE-2026-49099 — Updated!

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

SUSE CVE-2026-45760

Externally Controlled Reference to a Resource in Another Sphere, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)

An update for Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available RHBQ 3.33.2.SP3. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

The vulnerabilities of the components camel-langchain4j-tools, camel-langchain4j-agent, and camel-spring-ai-tools from the Java framework Apache Camel allow attackers to execute arbitrary code, perform SSRF attacks, or gain read-write access to arbitrary files.

The vulnerability of the components camel-langchain4j-tools, camel-langchain4j-agent, and camel-spring-ai-tools from the Java framework Apache Camel is related to insufficient input data validation. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code, perform an...

The vulnerability of the Apache Camel JIRA Java framework component allows a malicious individual to gain unauthorized access to read, modify, add, and delete objects.

The vulnerability of the Apache Camel JIRA Java framework involves bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an intruder to gain unauthorized access to read, modify, add, and delete objects in the target JIRA system...

The vulnerability of the sendEventNotification() and getQueryMap() functions in the WebsocketConsumer class of the camel-atmosphere-websocket component of the Apache Camel framework allows a attacker to disclose protected information.

The vulnerability of the sendEventNotification and getQueryMap functions in the WebsocketConsumer class of the camel-atmosphere-websocket component of the Apache Camel framework is related to insufficient validation of input data during the processing of WebSocket request parameters. Exploiting...