Vulnerability · Published Jan 14, 2026 · Assigned by apache
CVE-2025-66169Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component
Medium 5.3
In plain English
A medium-severity SQL injection in Apache Camel Neo4j from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.camel:camel-neo4j | 4.10.8 | GHSA-4jrw-64vr-7g8m |
| Maven | org.apache.camel:camel-neo4j | 4.14.3 | GHSA-4jrw-64vr-7g8m |
| Maven | org.apache.camel:camel-neo4j | 4.17.0 | GHSA-4jrw-64vr-7g8m |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Camel Neo4j | 4.10.0 – before 4.10.84.14.0 – before 4.14.34.15.0 – before 4.17.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N