CVE-2024-22369

CVE-2024-22369 is a deserialization of untrusted data vulnerability in Apache Camel SQL Component, related to unsafe deserialization in the JDBCAggregationRepository. Affected versions include Camel 3.0.0–3.21.3, 3.22.0–3.22.0, 4.0.0–4.0.3, and 4.1.0–4.3.x (per the advisory). The issue could allo...

CVE-2019-0188

Apache Camel before 2.24.0 is affected by an XXE vulnerability (CWE-611) caused by an outdated vulnerable JSON-lib in the camel-xmljson component, which has been removed in later releases. The issue is documented with CVE-2019-0188 and has a base score around 5.8 (IBM X-Force reference). Remediat...

CVE-2024-22371

Summary (CVE-2024-22371) Apache Camel contains a vulnerability where crafting a malicious EventFactory and supplying a custom ExchangeCreatedEvent could expose sensitive data. This affects Camel releases across multiple branches: 3.21.x (up to 3.21.3), 3.22.x (up to 3.22.0), 4.0.x (up to 4.0.3), ...

CVE-2020-11971

CVE-2020-11971: Apache Camel JMX Rebind Flaw affects Camel versions 2.22.x–3.1.0. The JMX rebind vulnerability could allow a remote attacker to access sensitive information via crafted requests. A fix is available: upgrade to Camel 3.2.0 or newer. CVSS scores reported include v3.1 base 7.5 (HIGH)...

CVE-2020-11994

CVE-2020-11994 is a Server-Side Template Injection in the Apache Camel templating component used by Oracle Enterprise Manager Cloud Control Base Platform (13.4.0.0), specifically in the Reporting Framework. The vulnerability enables arbitrary file disclosure and high-impact data exposure due to C...

CVE-2017-5643

The CVE-2017-5643 issue affects Apache Camel’s Validation Component, which is vulnerable to SSRF via remote DTDs and XML External Entities (XXE) in XML streams. The vulnerability arises when the component processes DTDs/XXEs, allowing remote resources to be fetched. Impact details in connected do...

CVE-2019-0194

CVE-2019-0194 affects Apache Camel’s File component and enables directory traversal in Camel versions 2.21.0–2.21.3, 2.22.0–2.22.2, 2.23.0, and some older 2.x lines. Connected sources confirm this is a known vulnerability in multiple products (e.g., IBM Tivoli Netcool/OMNIbus components and Resil...

CVE-2014-0002

CVE-2014-0002 affects Apache Camel XSLT component. The vulnerability arises when parsing XML with external entity references, allowing an attacker to read files and potentially perform XXE-based attacks. IBM security bulletins for IBM Application Performance Management (and related Red Hat adviso...

CVE-2014-0003

CVE-2014-0003 affects the Apache Camel XSLT component. It allows a remote attacker to execute arbitrary Java methods by sending a crafted message due to the XSLT component’s ability to call external Java methods. Affected are Camel 2.11.x prior to 2.11.4 and 2.12.x prior to 2.12.3 (and possibly e...

CVE-2026-43866

Summary : CVE-2026-43866 is a deserialization bypass in Apache Camel JMS components. When mapJmsMessage is enabled, camel-jms (and camel-sjms and JMS-family components) deserialize JMS ObjectMessage payloads via ObjectMessage.getObject(). Although a post-deserialization allow-list was added in CV...

CVE-2026-46588

Summary: CVE-2026-46588 is an Improper Input Validation vulnerability in Apache Camel affecting versions up to 4.14.7 and 4.15.0–4.18.2, 4.19.0–4.20.0. The issue stems from input validation weaknesses in Camel’s components, enabling potential impact on confidentiality, integrity, and availability...

CVE-2026-49042

CVE-2026-49042 : This is an Improper Input Validation vulnerability in Apache Camel affecting 4.8.0–4.18.2 and 4.19.0–4.20.0. The issue’s root cause is input validation weaknesses. Fixed in Camel releases 4.18.3 and 4.21.0. CVSSv3.1 base score 7.3 (HIGH) with NETWORK attack vector, NO privileges,...

CVE-2026-40048

CVE-2026-40048 – Apache Camel PQC deserialization flaw : The Camel-PQC FileBasedKeyLifecycleManager deserializes the contents of .key files in the configured key directory via java.io.ObjectInputStream without ObjectInputFilter or class-loading restrictions. The vulnerable step is that the cast t...

CVE-2026-46587

CVE-2026-46587 affects Apache Camel and is due to Improper Input Validation. The vulnerability impacts Camel up to 4.14.7 and from 4.15.0 through 4.18.2, and from 4.19.0 through 4.20.0. Affected product/version ranges are explicitly listed in the initial document; mitigation is to upgrade to a fi...

CVE-2026-55993

CVE-2026-55993 : Apache Camel Atmosphere Websocket Component contains an SSRF/Information Disclosure issue via improper input validation. The camel-atmosphere-websocket consumer maps inbound WebSocket query parameters into the Camel Exchange header map without a HeaderFilterStrategy, allowing ext...

CVE-2026-46592

This CVE concerns Apache Camel CXF SOAP component where the operationName/operationNamespace headers bypass the HTTP header filter, enabling a potential confused-deputy redirection to invoke a different WSDL operation. Affected range: Camel 4.0.0–4.14.8, 4.15.0–4.18.3, 4.19.0–4.21.0. Mitigation: ...

CVE-2026-55994

The CVE concerns Apache Camel Iggy: an attacker publishing to the Iggy stream can inject Camel control headers into inbound messages because the consumer maps external user-headers into the Exchange header map without a HeaderFilterStrategy. This enables Server-Side Request Forgery (SSRF) by redi...

CVE-2026-46585

The CVE describes an improper input validation/authorization bypass in the Apache Camel Lucene component. The root cause is that the Camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADER_QUERY) whose value is the plain string QUERY (and RETURN_LUCENE_DOCS f...

CVE-2026-46457

Summary: CVE-2026-46457 affects the Apache Camel NATS component. The issue arises when inbound NATS message headers are mapped into the Camel Exchange without a configured headerFilterStrategy, causing every NATS header (including Camel control headers) to be copied unmodified into the Camel mess...

CVE-2026-46726

Apache Camel Vertx Websocket: the inbound WebSocket consumer maps external query/path parameters into the Exchange header map without HeaderFilterStrategy, enabling injection of Camel headers (e.g., CamelHttpUri) and potential server-side request forgery (SSRF) to attacker-controlled URIs. The HT...