CVE-2025-27636

CVE-2025-27636 affects Apache Camel versions 4.10.0–4.10.1, 4.8.0–4.8.4, and 3.10.0–3.22.3. The root cause is a case-sensitive DefaultHeaderFilterStrategy that only blocks headers starting with Camel, camel, or org.apache.camel., allowing attackers to inject Camel-specific headers. In vulnerable ...

CVE-2026-49098

The CVE describes an injection-type flaw in the Apache Camel Kafka Component where the kafka.OVERRIDE_TOPIC (and related kafka.* headers) can override the endpoint topic at runtime. KafkaProducer.evaluateTopic() returns the header value in preference to the endpoint topic, and headers pass throug...

CVE-2026-48206

Apache Camel JIRA: A vulnerability allows an unauthenticated HTTP client to bypass input validation by supplying non-Camel header names (IssueKey, ProjectKey, IssueTransitionId, etc.) that flow into jira: producers. This lets the attacker potentially drive JIRA operations (delete/transition issue...

CVE-2026-46453

Technical details for CVE-2026-46453 are not publicly available in the provided documents. No affected products, versions, impact, or fixes are enumerated here. Monitor official advisories for updates.

CVE-2015-0263

Apache Camel contains an XXE in the XML converter setup (converter/jaxp/XmlConverter.java) affecting versions before 2.13.4 and 2.14.x before 2.14.2, allowing remote attackers to read arbitrary files via an external entity in SAXSource. Remediation: upgrade to Camel 2.13.4+ or 2.14.2+. Exploitati...

CVE-2018-8041

CVE-2018-8041 affects Apache Camel’s Mail component. Versions 2.20.0–2.20.3, 2.21.0–2.21.1, and 2.22.0 are vulnerable to a path traversal issue that can allow viewing arbitrary files via a crafted URL request. Root cause and exact exploit details are not provided in the supplied documents beyond ...

CVE-2015-0264

CVE-2015-0264: In Apache Camel, multiple XXE vulnerabilities exist in builder/xml/XPathBuilder.java that allow reading arbitrary files when processing invalid XML strings or GenericFile objects via an XML External Entity (XXE) declaration. Affected versions are Camel before 2.13.4 and 2.14.x befo...

CVE-2026-49099

Summary: CVE-2026-49099 affects the Apache Camel Salesforce component. Non-Camel header constants (e.g., sObjectQuery, apexUrl) bypass the HTTP header filter, allowing an unauthenticated HTTP client to influence internal behavior by setting operation parameters (SOQL/SOSL, SObject name/id, Apex U...

CVE-2026-49365

The vulnerability CVE-2026-49365 affects Apache Camel’s camel-netty-http server consumer. The root cause is that the default of muteException is false, so on route processing errors Camel writes the full Java stack trace into the HTTP response body instead of an empty body. This can disclose sens...

CVE-2026-56139

CVE-2026-56139 concerns Apache Camel Undertow: the muteException option on the Undertow HTTP server consumer defaulted to false, causing processing errors to return the full Java stack trace in HTTP responses. This exposed sensitive information (credentials in messages, host/IPs, filesystem paths...

CVE-2026-60093

CVE-2026-60093 is a relative path traversal (CWE-22) in the Apache Camel camel-azure-storage-datalake component (versions 4.0.0–4.21.x, fixed in 4.14.9 / 4.18.4 / 4.22.0 ). The downloadToFile operation joined the configured fileDir with the remote file name from Azure Data Lake Gen2 without lexic...

CVE-2026-63621

CVE-2026-63621 is a header-injection vulnerability in the camel-knative component of Apache Camel . In structured CloudEvent mode (application/cloudevents+json), extension fields from the JSON body are copied into Exchange headers without applying a HeaderFilterStrategy, unlike the binary-mode pa...

CVE-2025-66169

The CVE-2025-66169 entry concerns a Cypher Injection vulnerability in the Apache Camel camel-neo4j component. Affected versions are 4.10.0 before 4.10.8, 4.14.0 before 4.14.3, and 4.15.0 before 4.17.0. The underlying issue is improper handling of Cypher queries, leading to potential unauthorized ...