CVE-2024-22369

Apache Camel is vulnerable to arbitrary code execution via unsafe deserialization in the JDBCAggregationRepository component (and potentially others like SQL Component ). An attacker can send a specially crafted request to trigger the deserialization of untrusted data. This issue affects Apache C...

CVE-2024-23114

Apache Camel is vulnerable to a deserialization of untrusted data (CWE-502) vulnerability within its CassandraQL Component AggregationRepository . The root cause is the unsafe deserialization of malicious payloads under specific conditions, which can lead to arbitrary code execution on the system...

CVE-2025-27636

Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through

CVE-2026-49098

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kafka Component. The camel-kafka producer can override its configured target topic at runtime from the kafka.OVERRIDE_TOPIC Exchange header: ...

CVE-2025-29891

Apache Camel contains a Bypass/Injection vulnerability (CVE-2025-29891) caused by a case-sensitive header filtering mechanism. The default filter only blocks headers starting with "Camel", "camel", or "org.apache.camel", allowing attackers to inject headers using altered casing (e.g., "CAmelExecC...

CVE-2026-46453

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elas...

CVE-2019-0188

Apache Camel before 2.24.0 is affected by an XXE vulnerability (CWE-611) caused by an outdated vulnerable JSON-lib in the camel-xmljson component, which has been removed in later releases. The issue is documented with CVE-2019-0188 and has a base score around 5.8 (IBM X-Force reference). Remediat...

CVE-2026-48206

The Apache Camel JIRA component is vulnerable to an Authorization Bypass (CWE-639) and Improper Input Validation (CWE-20) due to the use of non-Camel-prefixed header constants like IssueKey and ProjectKey. Because the HttpHeaderFilterStrategy only blocks the Camel namespace, these headers can byp...

CVE-2024-22371

Summary (CVE-2024-22371) Apache Camel contains a vulnerability where crafting a malicious EventFactory and supplying a custom ExchangeCreatedEvent could expose sensitive data. This affects Camel releases across multiple branches: 3.21.x (up to 3.21.3), 3.22.x (up to 3.22.0), 4.0.x (up to 4.0.3), ...

CVE-2020-11971

CVE-2020-11971: Apache Camel JMX Rebind Flaw affects Camel versions 2.22.x–3.1.0. The JMX rebind vulnerability could allow a remote attacker to access sensitive information via crafted requests. A fix is available: upgrade to Camel 3.2.0 or newer. CVSS scores reported include v3.1 base 7.5 (HIGH)...

CVE-2016-8749

Apache Camel (camel-jackson and camel-jacksonxml) is affected by CVE-2016-8749 due to unsafe Java object deserialization during Jackson/JacksonXML unmarshalling, enabling remote code execution. The issue is documented across multiple feeds (GHSA and Red Hat advisories) and affects Camel component...

CVE-2020-11994

CVE-2020-11994 is a Server-Side Template Injection in the Apache Camel templating component used by Oracle Enterprise Manager Cloud Control Base Platform (13.4.0.0), specifically in the Reporting Framework. The vulnerability enables arbitrary file disclosure and high-impact data exposure due to C...

CVE-2026-40453

Apache Camel contains an incomplete fix for CVE-2025-27636 affecting the camel-jms, camel-sjms, camel-coap, and camel-google-pubsub components. Specifically, the JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy, SjmsHeaderFilterStrategy, CoAPHeaderFilterStrategy, and GooglePubsubHeaderFilt...

CVE-2020-5529

CVE-2020-5529 affects HtmlUnit prior to 2.37.0, where improper Rhino engine initialization enables a malicious JavaScript to execute arbitrary Java code within the application. The issue also extends to Android environments where Android-specific Rhino initialization is mishandled, allowing simil...

CVE-2017-5643

The CVE-2017-5643 issue affects Apache Camel’s Validation Component, which is vulnerable to SSRF via remote DTDs and XML External Entities (XXE) in XML streams. The vulnerability arises when the component processes DTDs/XXEs, allowing remote resources to be fetched. Impact details in connected do...

CVE-2017-3159

CVE-2017-3159 affects Apache Camel's camel-snakeyaml component, enabling Java deserialization that can lead to remote code execution when untrusted data is deserialized. The NVD entry assigns a high/critical impact (CVSS v3 base 9.8, NETWORK/LOW complexity, no authentication) with potential execu...

CVE-2019-0194

CVE-2019-0194 affects Apache Camel’s File component and enables directory traversal in Camel versions 2.21.0–2.21.3, 2.22.0–2.22.2, 2.23.0, and some older 2.x lines. Connected sources confirm this is a known vulnerability in multiple products (e.g., IBM Tivoli Netcool/OMNIbus components and Resil...

CVE-2013-4330

CVE-2013-4330 is an Apache Camel remote code execution vulnerability caused by improper handling of the CamelFileName header when using FILE or FTP producers. Affected Camel core versions include 2.9.7 and earlier, as well as 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0, per the CVE des...

CVE-2014-0003

CVE-2014-0003 affects the Apache Camel XSLT component. It allows a remote attacker to execute arbitrary Java methods by sending a crafted message due to the XSLT component’s ability to call external Java methods. Affected are Camel 2.11.x prior to 2.11.4 and 2.12.x prior to 2.12.3 (and possibly e...

CVE-2014-0002

CVE-2014-0002 affects Apache Camel XSLT component. The vulnerability arises when parsing XML with external entity references, allowing an attacker to read files and potentially perform XXE-based attacks. IBM security bulletins for IBM Application Performance Management (and related Red Hat adviso...

CVE-2020-11972

CVE-2020-11972 affects Apache Camel RabbitMQ: Java deserialization is enabled by default in the RabbitMQ component, enabling remote code execution. Affected Camel versions include 2.22.x, 2.23.x, 2.24.x, 2.25.0, and 3.0.0 up to 3.1.0. To mitigate, upgrade 2.x line to 2.25.1 or the 3.x line to 3.2...

CVE-2020-11973

CVE-2020-11973 affects Apache Camel with Netty, enabling Java deserialization due to unsafe/deserialized handling. Affected Camel versions: 2.22.x, 2.23.x, 2.24.x, 2.25.0, up to 3.1.0. Remediation is upgrade to Camel 2.25.1 (2.x line) or 3.2.0 (3.x line); no exploit details are provided in the do...

CVE-2026-33454

The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith. As a ...

CVE-2026-33453

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sens...

CVE-2017-12633

The CVE-2017-12633 issue affects the Apache Camel camel-hessian component in Camel 2.x, due to a Java object deserialization vulnerability. Affected versions are Camel 2.x before 2.19.4 and 2.20.x before 2.20.1. Exploitation could enable remote code execution by deserializing untrusted data, with...

CVE-2015-5344

Apache Camel camel-xstream component suffers a remote code execution risk due to deserialization of untrusted data. The affected component is Camel XStream, with versions prior to 2.15.5 and 2.16.x prior to 2.16.1. The root cause is deserialization of crafted serialized Java objects, and exploita...

CVE-2015-5348

CVE-2015-5348 affects Apache Camel: deserialization of HTTP requests using content-header: application/x-java-serialized-object via camel-jetty or camel-servlet, allowing remote code execution. Affected: Camel 2.6.x–2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1. Root cause: insecure Java...

CVE-2017-12634

The camel-castor component in Apache Camel 2.x is vulnerable to Java object deserialization (CVE-2017-12634). Affected versions are 2.x before 2.19.4 and 2.20.x before 2.20.1. Deserializing untrusted data can lead to security flaws, including potential Remote Code Execution. The CVSSv3 base score...

CVE-2025-30177

The Apache Camel framework is vulnerable to a message header injection flaw within the Camel-Undertow component. The root cause is that the custom header filter strategy only filters headers in the "out" direction, failing to filter the "in" direction. This allows an attacker to inject Camel-spec...

CVE-2015-0263

Apache Camel contains an XXE in the XML converter setup (converter/jaxp/XmlConverter.java) affecting versions before 2.13.4 and 2.14.x before 2.14.2, allowing remote attackers to read arbitrary files via an external entity in SAXSource. Remediation: upgrade to Camel 2.13.4+ or 2.14.2+. Exploitati...

CVE-2018-8041

CVE-2018-8041 affects Apache Camel’s Mail component. Versions 2.20.0–2.20.3, 2.21.0–2.21.1, and 2.22.0 are vulnerable to a path traversal issue that can allow viewing arbitrary files via a crafted URL request. Root cause and exact exploit details are not provided in the supplied documents beyond ...

CVE-2015-0264

CVE-2015-0264: In Apache Camel, multiple XXE vulnerabilities exist in builder/xml/XPathBuilder.java that allow reading arbitrary files when processing invalid XML strings or GenericFile objects via an XML External Entity (XXE) declaration. Affected versions are Camel before 2.13.4 and 2.14.x befo...

CVE-2026-40473

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput...

CVE-2023-34442

CVE-2023-34442 concerns Apache Camel (JIRA integration) with information disclosure due to improper authorization validation in the Camel-Jira FileConverter, enabling a local or authenticated actor to view temporary file contents. Affected versions include Camel 3.x up to <=3.14.8, 3.18.x up t...

CVE-2026-40860

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path ...

CVE-2018-8027

Apache Camel Core is vulnerable to XML External Entity (XXE) processing in the XSD validation processor. Affected versions are 2.20.0–2.20.3 and 2.21.0. Root cause: improper handling of XML external entities in the XSD validation path, enabling a remote attacker to read arbitrary files when a vic...

CVE-2026-43866

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever th...

CVE-2026-47323

Apache Camel is vulnerable to message header injection due to missing inbound filtering in the CxfRsHeaderFilterStrategy (camel-cxf-rest), CxfHeaderFilterStrategy (camel-cxf-transport), and KnativeHttpHeaderFilterStrategy (camel-knative-http) components. These implementations only filter outbound...

CVE-2026-23552

Apache Camel versions 4.15.0 through 4.17.0 are vulnerable to a Cross-Realm Token Acceptance Bypass in the KeycloakSecurityPolicy component. The root cause is that the component fails to validate the iss (issuer) claim of JWT tokens against the configured realm. When no public key is explicitly p...

CVE-2026-27172

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputF...

CVE-2026-43867

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from t...

CVE-2026-40858

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a...

CVE-2026-55993

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange head...

CVE-2026-49042

Apache Camel components camel-langchain4j-tools , camel-langchain4j-agent , and camel-spring-ai-tools are vulnerable to improper input validation (CWE-20) in versions 4.8.0–4.18.2 and 4.19.0–4.20.x . The root cause is that the LangChain4jToolsProducer#invokeTools method copies all fields from an ...

CVE-2026-46584

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were prese...

CVE-2026-48204

Apache Camel's camel-mongodb-gridfs component is vulnerable to Improper Input Validation and Improper Access Control in versions 4.0.0 to 4.20.9. The GridFsProducer class uses plain strings for control headers (e.g., gridfs.operation, gridfs.objectid) which do not start with the required Camel/ p...

CVE-2026-25747

CVE-2026-25747 describes a Deserialization of Untrusted Data vulnerability in the Apache Camel LevelDB component. The issue stems from the DefaultLevelDBSerializer using java.io.ObjectInputStream to read from the LevelDB aggregation repository without ObjectInputFilter or class-loading restrictio...

CVE-2026-48205

Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers w...

CVE-2026-49086

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPub...

CVE-2026-49099

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL searc...