CVE-2013-4330

CVE-2013-4330 is an Apache Camel remote code execution vulnerability caused by improper handling of the CamelFileName header when using FILE or FTP producers. Affected Camel core versions include 2.9.7 and earlier, as well as 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0, per the CVE des...

CVE-2025-30177

Apache Camel vulnerability CVE-2025-30177 affects Camel-Undertow in Camel versions 4.10.0–4.10.3 and 4.8.0–4.8.6, where the DefaultHeaderFilterStrategy is insufficiently filtering incoming headers. The issue allows Camel-specific headers to bypass the header filter (notably in the Camel-Undertow ...

CVE-2026-49086

CVE-2026-49086 (Apache Camel DAPR): Affects Camel DAPR Pub/Sub consumer where inbound CloudEvent fields pub/sub-name and topic are copied into routing headers (CamelDaprPubSubName, CamelDaprTopic). The headers are used to direct where messages are published, enabling an attacker who can publish t...

CVE-2026-49097

CVE-2026-49097 affects Apache Camel’s Camel-IRC component. The issue arises when outbound IRC message destinations are taken from non-Camel header names (irc.sendTo and related irc.* headers), which bypass the HTTP header filter. In routes bridging HTTP to irc:, an attacker could set irc.sendTo t...

CVE-2026-59230

Apache Camel's camel-mail component (MimeMultipart data format) is vulnerable to header injection when headersInline is explicitly set to true. During unmarshalling, MIME headers from the incoming message are copied onto the Camel Exchange via setHeader without a HeaderFilterStrategy, allowing a ...