Apache Camel vulnerabilities

49 known vulnerabilities in Apache Camel from Apache. 49 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Camel: Improper Restriction of XML External Entity Reference

  CVE-2026-90885Oct 26, 2026Apache

  Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery

• 8.8 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-88900Oct 19, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every m

• 8.2 High severity

  Apache Camel: Improper Restriction of XML External Entity Reference

  CVE-2026-88901Oct 19, 2026Apache

  Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (camel-smoo

• 7.5 High severity

  Apache Camel: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-85251Oct 19, 2026Apache

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host ch

• 7.5 High severity

  Apache Camel: Improper Restriction of XML External Entity Reference

  CVE-2026-85250Oct 19, 2026Apache

  Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload str

• 8.8 High severity

  Apache Camel: Improper Control of Generation of Code

  CVE-2026-83531Oct 19, 2026Apache

  Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before

• 8.2 High severity

  Apache Camel: Server-Side Request Forgery

  CVE-2026-80344Oct 19, 2026Apache

  Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition Notificat

• 8.2 High severity

  Apache Camel: Improper Handling of Case Sensitivity

  CVE-2026-80343Oct 19, 2026Apache

  Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the confi

• 8.2 High severity

  Apache Camel: Improper Authentication

  CVE-2026-80312Oct 19, 2026Apache

  Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not

• 9.1 Critical severity

  Apache Camel: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-79986Oct 19, 2026ApacheEPSS 1.02%

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a dir

• 7.4 High severity

  Apache Camel: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-79985Oct 19, 2026Apache

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory o

• 7.4 High severity

  Apache Camel: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-79984Oct 19, 2026Apache

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a dire

• 9.1 Critical severity

  Apache Camel: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-79983Oct 19, 2026ApacheEPSS 1.02%

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory o

• 8.8 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-78165Oct 19, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer

• 8.2 High severity

  Apache Camel: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-78164Oct 19, 2026Apache

  Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.

• 9.8 Critical severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-78162Oct 19, 2026ApacheEPSS 1.08%

  Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it c

• 9.8 Critical severity

  Improper input validation vulnerability in Apache Camel Undertow component.

  CVE-2026-78329Aug 24, 2026Apache

  Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base

• 9.8 Critical severity

  Improper input validation vulnerability in Apache Camel Atmosphere Websocket component.

  CVE-2026-71300Aug 24, 2026Apache

  Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which conne

• 7.5 High severity

  Apache Camel: Improper Authentication

  CVE-2026-66908Aug 24, 2026Apache

  Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticat

• 7.5 High severity

  Apache Camel: Relative Path Traversal

  CVE-2026-66907Aug 24, 2026Apache

  Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage ob

• 9.1 Critical severity

  Apache Camel: Relative Path Traversal

  CVE-2026-66906Aug 24, 2026Apache

  Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure St

• 7.3 High severity

  Improper Input Validation vulnerability in Apache Camel.

  CVE-2026-49042Jul 6, 2026Apache

  Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

• 7.3 High severity

  Improper Input Validation vulnerability in Apache Camel.

  CVE-2026-46588Jul 6, 2026Apache

  Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

• 7.3 High severity

  Improper Input Validation vulnerability in Apache Camel.

  CVE-2026-46587Jul 6, 2026Apache

  Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

• 9.8 Critical severity

  Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel…

  CVE-2026-48204Jul 6, 2026Apache

  Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operatio

• 9.1 Critical severity

  Improper Neutralization of Special Elements in Output Used by a Downstream Component…

  CVE-2026-48203Jul 6, 2026Apache

  Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message head

• 7.5 High severity

  Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability…

  CVE-2026-46592Jul 6, 2026Apache

  Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespac

• 8.2 High severity

  Apache Camel: Improper Neutralization of Special Elements in Data Query Logic

  CVE-2026-46591Jul 6, 2026Apache

  Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025

• 8.8 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-46590Jul 6, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManag

• 7.5 High severity

  Improper Input Validation vulnerability in Apache Camel NATS component.

  CVE-2026-46457Jul 6, 2026Apache

  Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy() with no inbound rules

• 9.8 Critical severity

  Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component.

  CVE-2026-46456Jul 6, 2026Apache

  Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbo

• 9.8 Critical severity

  Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.

  CVE-2026-46455Jul 6, 2026Apache

  Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and t

• 9.8 Critical severity

  Improper Input Validation vulnerability in Apache Camel Cometd Component.

  CVE-2026-46454Jul 6, 2026Apache

  Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies

• 9.8 Critical severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-43867Jul 6, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetad

• 7.3 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-43866Jul 6, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.

• 8.1 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-43865Jul 6, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcas

• 8.1 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-42527Jul 6, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**'

• 8.1 High severity

  Apache Camel: Deserialization of Untrusted Data

  CVE-2026-40859Jul 6, 2026Apache

  Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectI

• 9.1 Critical severity

  Apache Camel: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-40047Jul 6, 2026ApacheEPSS 2.43%

  Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer a

• 9.8 Critical severity

  Apache Camel: Improper Handling of Case Sensitivity

  CVE-2026-47323May 19, 2026ApacheEPSS 19.6%

  Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilte