CVE-2024-22369

Apache Camel's SQL Component contains a deserialization of untrusted data vulnerability (CWE-502) within the JDBCAggregationRepository component. The root cause is insufficient validation of serialized objects, which can allow a remote attacker to execute arbitrary code on the system by sending a...

CVE-2024-23114

Apache Camel is vulnerable to a Deserialization of Untrusted Data vulnerability (CWE-502) within the CassandraQL Component AggregationRepository . The root cause is the unsafe deserialization of malicious payloads under specific conditions. This issue affects Apache Camel versions 3.0.0 before 3....

CVE-2025-27636

Apache Camel is vulnerable to a bypass/injection vulnerability in its default incoming header filter. The flaw allows attackers to inject Camel-specific headers using mixed-case strings (e.g., CAmelExecCommandExecutable) that bypass the filter's check for headers starting with "Camel", "camel", o...

CVE-2026-49098

The Apache Camel Kafka Component (specifically the camel-kafka component) is vulnerable to an injection flaw due to improper input validation in the KafkaProducer.evaluateTopic() function. The root cause is that the kafka.* namespace headers, such as kafka.OVERRIDE_TOPIC, are not prefixed with Ca...

CVE-2019-0188

Apache Camel before 2.24.0 is affected by an XXE vulnerability (CWE-611) caused by an outdated vulnerable JSON-lib in the camel-xmljson component, which has been removed in later releases. The issue is documented with CVE-2019-0188 and has a base score around 5.8 (IBM X-Force reference). Remediat...

CVE-2025-29891

Apache Camel is vulnerable to a bypass/injection flaw in its default incoming header filter due to improper neutralization of internal special elements. This allows an attacker to inject Camel-specific headers, which can alter the behavior of components like camel-bean or camel-exec . If an appli...

CVE-2026-46453

The camel-elasticsearch-rest-client component in Apache Camel is vulnerable to an authorization bypass and header injection due to improper input validation. The component uses unprefixed header constants (e.g., SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, ID) that bypass the default Http...

CVE-2026-48206

The Apache Camel JIRA component is vulnerable to an Authorization Bypass (CWE-639) and Improper Input Validation (CWE-20) due to the use of non-Camel-prefixed header constants like IssueKey and ProjectKey. Because the HttpHeaderFilterStrategy only blocks the Camel namespace, these headers can byp...

CVE-2024-22371

Summary (CVE-2024-22371) Apache Camel contains a vulnerability where crafting a malicious EventFactory and supplying a custom ExchangeCreatedEvent could expose sensitive data. This affects Camel releases across multiple branches: 3.21.x (up to 3.21.3), 3.22.x (up to 3.22.0), 4.0.x (up to 4.0.3), ...

CVE-2020-11971

CVE-2020-11971: Apache Camel JMX Rebind Flaw affects Camel versions 2.22.x–3.1.0. The JMX rebind vulnerability could allow a remote attacker to access sensitive information via crafted requests. A fix is available: upgrade to Camel 3.2.0 or newer. CVSS scores reported include v3.1 base 7.5 (HIGH)...

CVE-2016-8749

Apache Camel (camel-jackson and camel-jacksonxml) is affected by CVE-2016-8749 due to unsafe Java object deserialization during Jackson/JacksonXML unmarshalling, enabling remote code execution. The issue is documented across multiple feeds (GHSA and Red Hat advisories) and affects Camel component...

CVE-2020-11994

CVE-2020-11994 is a Server-Side Template Injection in the Apache Camel templating component used by Oracle Enterprise Manager Cloud Control Base Platform (13.4.0.0), specifically in the Reporting Framework. The vulnerability enables arbitrary file disclosure and high-impact data exposure due to C...

CVE-2020-5529

CVE-2020-5529 affects HtmlUnit prior to 2.37.0, where improper Rhino engine initialization enables a malicious JavaScript to execute arbitrary Java code within the application. The issue also extends to Android environments where Android-specific Rhino initialization is mishandled, allowing simil...

CVE-2026-40453

Apache Camel contains an incomplete fix for CVE-2025-27636 affecting the camel-jms, camel-sjms, camel-coap, and camel-google-pubsub components. Specifically, the JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy, SjmsHeaderFilterStrategy, CoAPHeaderFilterStrategy, and GooglePubsubHeaderFilt...

CVE-2017-5643

The CVE-2017-5643 issue affects Apache Camel’s Validation Component, which is vulnerable to SSRF via remote DTDs and XML External Entities (XXE) in XML streams. The vulnerability arises when the component processes DTDs/XXEs, allowing remote resources to be fetched. Impact details in connected do...

CVE-2017-3159

CVE-2017-3159 affects Apache Camel's camel-snakeyaml component, enabling Java deserialization that can lead to remote code execution when untrusted data is deserialized. The NVD entry assigns a high/critical impact (CVSS v3 base 9.8, NETWORK/LOW complexity, no authentication) with potential execu...

CVE-2019-0194

CVE-2019-0194 affects Apache Camel’s File component and enables directory traversal in Camel versions 2.21.0–2.21.3, 2.22.0–2.22.2, 2.23.0, and some older 2.x lines. Connected sources confirm this is a known vulnerability in multiple products (e.g., IBM Tivoli Netcool/OMNIbus components and Resil...

CVE-2014-0003

CVE-2014-0003 affects the Apache Camel XSLT component. It allows a remote attacker to execute arbitrary Java methods by sending a crafted message due to the XSLT component’s ability to call external Java methods. Affected are Camel 2.11.x prior to 2.11.4 and 2.12.x prior to 2.12.3 (and possibly e...

CVE-2026-33453

The Apache Camel camel-coap component is vulnerable to header injection because it maps CoAP request URI query parameters directly into Camel Exchange In message headers without applying a HeaderFilterStrategy . Specifically, CamelCoapResource.handleRequest() iterates over OptionSet.getUriQuery()...

CVE-2013-4330

CVE-2013-4330 is an Apache Camel remote code execution vulnerability caused by improper handling of the CamelFileName header when using FILE or FTP producers. Affected Camel core versions include 2.9.7 and earlier, as well as 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0, per the CVE des...

CVE-2014-0002

CVE-2014-0002 affects Apache Camel XSLT component. The vulnerability arises when parsing XML with external entity references, allowing an attacker to read files and potentially perform XXE-based attacks. IBM security bulletins for IBM Application Performance Management (and related Red Hat adviso...

CVE-2026-33454

The Apache Camel camel-mail component is vulnerable to Camel message header injection due to a flaw in the MailHeaderFilterStrategy class. The component incorrectly configures filters for only the out direction (setOutFilterStartsWith) while failing to configure the in direction via setInFilterSt...

CVE-2020-11972

CVE-2020-11972 affects Apache Camel RabbitMQ: Java deserialization is enabled by default in the RabbitMQ component, enabling remote code execution. Affected Camel versions include 2.22.x, 2.23.x, 2.24.x, 2.25.0, and 3.0.0 up to 3.1.0. To mitigate, upgrade 2.x line to 2.25.1 or the 3.x line to 3.2...

CVE-2020-11973

CVE-2020-11973 affects Apache Camel with Netty, enabling Java deserialization due to unsafe/deserialized handling. Affected Camel versions: 2.22.x, 2.23.x, 2.24.x, 2.25.0, up to 3.1.0. Remediation is upgrade to Camel 2.25.1 (2.x line) or 3.2.0 (3.x line); no exploit details are provided in the do...

CVE-2017-12633

The CVE-2017-12633 issue affects the Apache Camel camel-hessian component in Camel 2.x, due to a Java object deserialization vulnerability. Affected versions are Camel 2.x before 2.19.4 and 2.20.x before 2.20.1. Exploitation could enable remote code execution by deserializing untrusted data, with...

CVE-2015-5344

Apache Camel camel-xstream component suffers a remote code execution risk due to deserialization of untrusted data. The affected component is Camel XStream, with versions prior to 2.15.5 and 2.16.x prior to 2.16.1. The root cause is deserialization of crafted serialized Java objects, and exploita...

CVE-2026-43866

Apache Camel's camel-jms , camel-sjms , camel-sjms2 , camel-amqp , camel-activemq , and camel-activemq6 components are vulnerable to a deserialization of untrusted data (CWE-502) bypass of CVE-2026-40860. The JmsBinding.extractBodyFromJms() function deserializes incoming jakarta.jms.ObjectMessage...

CVE-2017-12634

The camel-castor component in Apache Camel 2.x is vulnerable to Java object deserialization (CVE-2017-12634). Affected versions are 2.x before 2.19.4 and 2.20.x before 2.20.1. Deserializing untrusted data can lead to security flaws, including potential Remote Code Execution. The CVSSv3 base score...

CVE-2025-30177

The Apache Camel framework is vulnerable to a message header injection flaw in the Camel-Undertow component. The root cause is that the custom header filter strategy only applies to outgoing messages and fails to filter incoming requests. This oversight allows an unauthenticated attacker to injec...

CVE-2015-5348

CVE-2015-5348 affects Apache Camel: deserialization of HTTP requests using content-header: application/x-java-serialized-object via camel-jetty or camel-servlet, allowing remote code execution. Affected: Camel 2.6.x–2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1. Root cause: insecure Java...

CVE-2015-0263

Apache Camel contains an XXE in the XML converter setup (converter/jaxp/XmlConverter.java) affecting versions before 2.13.4 and 2.14.x before 2.14.2, allowing remote attackers to read arbitrary files via an external entity in SAXSource. Remediation: upgrade to Camel 2.13.4+ or 2.14.2+. Exploitati...

CVE-2018-8041

CVE-2018-8041 affects Apache Camel’s Mail component. Versions 2.20.0–2.20.3, 2.21.0–2.21.1, and 2.22.0 are vulnerable to a path traversal issue that can allow viewing arbitrary files via a crafted URL request. Root cause and exact exploit details are not provided in the supplied documents beyond ...

CVE-2026-40473

The camel-mina component in Apache Camel is vulnerable to unsafe deserialization (CWE-502) because the MinaConverter.toObjectInput(IoBuffer) method wraps an IoBuffer in a raw java.io.ObjectInputStream without applying an ObjectInputFilter or any class-loading restrictions. This flaw allows an att...

CVE-2015-0264

CVE-2015-0264: In Apache Camel, multiple XXE vulnerabilities exist in builder/xml/XPathBuilder.java that allow reading arbitrary files when processing invalid XML strings or GenericFile objects via an XML External Entity (XXE) declaration. Affected versions are Camel before 2.13.4 and 2.14.x befo...

CVE-2023-34442

CVE-2023-34442 concerns Apache Camel (JIRA integration) with information disclosure due to improper authorization validation in the Camel-Jira FileConverter, enabling a local or authenticated actor to view temporary file contents. Affected versions include Camel 3.x up to <=3.14.8, 3.18.x up t...

CVE-2026-40860

Apache Camel is vulnerable to remote code execution (RCE) due to unsafe deserialization in the camel-jms component and related JMS-family components (including camel-sjms , camel-sjms2 , camel-amqp , camel-activemq , and camel-activemq6 ). The root cause is that JmsBinding.extractBodyFromJms() de...

CVE-2018-8027

Apache Camel Core is vulnerable to XML External Entity (XXE) processing in the XSD validation processor. Affected versions are 2.20.0–2.20.3 and 2.21.0. Root cause: improper handling of XML external entities in the XSD validation path, enabling a remote attacker to read arbitrary files when a vic...

CVE-2026-49086

The Apache Camel camel-dapr component is vulnerable to a confused deputy flaw (CWE-441 ) due to improper input validation. The DaprPubSubConsumer incorrectly copies the pubsubName and topic fields from untrusted inbound CloudEvents into the CamelDaprPubSubName and CamelDaprTopic Exchange headers....

CVE-2026-47323

Apache Camel is vulnerable to message header injection due to missing inbound filtering in the CxfRsHeaderFilterStrategy (camel-cxf-rest), CxfHeaderFilterStrategy (camel-cxf-transport), and KnativeHttpHeaderFilterStrategy (camel-knative-http) components. These implementations only filter outbound...

CVE-2026-43867

The Apache Camel PQC Component is vulnerable to deserialization of untrusted data in the AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method. The root cause is the use of a raw java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list to process Base64-...

CVE-2026-23552

Apache Camel versions 4.15.0 through 4.17.0 are vulnerable to a Cross-Realm Token Acceptance Bypass in the KeycloakSecurityPolicy component. The root cause is that the component fails to validate the iss (issuer) claim of JWT tokens against the configured realm. When no public key is explicitly p...

CVE-2026-55993

Apache Camel's camel-atmosphere-websocket component contains an Improper Input Validation vulnerability where inbound WebSocket query parameters are mapped into the Camel Exchange header map without a HeaderFilterStrategy . This allows an unauthenticated remote attacker to inject internal control...

CVE-2026-27172

The camel-consul component in Apache Camel is vulnerable to CWE-502 (Deserialization of Untrusted Data) due to the ConsulRegistry class. The ConsulRegistryUtils.deserialize method reads Java-serialized values from a Consul KV store and passes them to ObjectInputStream.readObject() without an Obje...

CVE-2026-49042

Apache Camel components camel-langchain4j-tools , camel-langchain4j-agent , and camel-spring-ai-tools are vulnerable to improper input validation (CWE-20) in versions 4.8.0–4.18.2 and 4.19.0–4.20.x . The root cause is that the LangChain4jToolsProducer#invokeTools method copies all fields from an ...

CVE-2026-40858

The camel-infinispan component in Apache Camel contains an unsafe deserialization vulnerability in its ProtoStream-based remote aggregation repository . The root cause is that DefaultExchangeHolderUtils.deserialize(byte[]) utilizes java.io.ObjectInputStream without an ObjectInputFilter , allowing...

CVE-2026-48204

Apache Camel's camel-mongodb-gridfs component is vulnerable to Improper Input Validation and Improper Access Control in versions 4.0.0 to 4.20.9. The GridFsProducer class uses plain strings for control headers (e.g., gridfs.operation, gridfs.objectid) which do not start with the required Camel/ p...

CVE-2026-25747

CVE-2026-25747 describes a Deserialization of Untrusted Data vulnerability in the Apache Camel LevelDB component. The issue stems from the DefaultLevelDBSerializer using java.io.ObjectInputStream to read from the LevelDB aggregation repository without ObjectInputFilter or class-loading restrictio...

CVE-2026-66906

The camel-azure-storage-blob component in Apache Camel is vulnerable to a relative path traversal (CWE-22) because the downloadBlobToFile operation fails to perform lexical normalization or boundary checks on remote blob names. When downloading blobs to the directory specified by the fileDir opti...

CVE-2026-46584

Apache Camel's camel-mail component contains an improper input validation vulnerability (CVE-2026-46584) in the MailProducer.getSender(Exchange) method. The producer scans inbound Exchange headers for the internal mail.smtp. or mail.smtps. namespaces and applies them as JavaMail session propertie...

CVE-2026-48205

The Apache Camel DNS component is vulnerable to Server-Side Request Forgery (SSRF) via DNS due to improper input validation in the camel-dns producers. The component reads operation parameters (resolver, name, domain, record type, class, and search term) from Exchange headers using plain strings ...