Apache Software Foundation Apache Camel

• CVE-2026-66908 High 7.5 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted 0.6%
• CVE-2026-66907 High 7.5 Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result 0.8%
• CVE-2026-66906 Critical 9.1 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir 0.8%
• CVE-2026-60093 Medium 5.5 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir 0.2%
• CVE-2026-59230 Medium 6.5 Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled 0.7%
• CVE-2026-46588 High 7.3 Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input 0.7%
• CVE-2026-46587 High 7.3 Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input 0.7%
• CVE-2026-49042 High 7.3 Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters 0.7%
• CVE-2026-43866 High 7.3 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder 0.7%
• CVE-2026-43867 Critical 9.8 Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter 0.9%
• CVE-2026-49365 Medium 5.3 Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients 0.6%
• CVE-2026-49098 Medium 5.3 Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic 0.6%
• CVE-2026-49097 Medium 6.5 Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users 0.7%
• CVE-2026-48204 Critical 9.8 Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration 0.7%
• CVE-2026-48203 Critical 9.1 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields 0.6%
• CVE-2026-46592 High 7.5 Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation 0.6%
• CVE-2026-46591 High 8.2 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169) 0.5%
• CVE-2026-46590 High 8.8 Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048) 0.8%
• CVE-2026-46457 High 7.5 Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers 0.7%
• CVE-2026-46456 Critical 9.8 Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers 0.8%
• CVE-2026-46455 Critical 9.8 Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted 0.7%
• CVE-2026-46454 Critical 9.8 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers 0.8%
• CVE-2026-46453 Medium 5.3 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation 0.6%
• CVE-2026-43865 High 8.1 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution 1.0%
• CVE-2026-42527 High 8.1 Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure 0.7%
• CVE-2026-40859 High 8.1 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled 0.9%
• CVE-2026-40047 Critical 9.1 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer 2.4%
• CVE-2026-47323 Critical 9.8 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering 19.6%
• CVE-2026-27172 High 8.8 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store 1.2%
• CVE-2026-33453 Critical 10.0 Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution 9.2%
• CVE-2026-33454 Critical 9.4 Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant) 1.5%
• CVE-2026-40858 High 8.8 Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository 1.3%
• CVE-2026-40860 Critical 9.8 Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp 1.7%
• CVE-2026-23552 Critical 9.1 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy 0.6%
• CVE-2025-30177 Medium 6.5 Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering 1.3%
• CVE-2025-29891 Medium 4.8 Apache Camel: Camel Message Header Injection through request parameters 76.1%
• CVE-2025-27636 Medium 5.6 Apache Camel: Camel Message Header Injection via Improper Filtering 97.1%
• CVE-2024-22371 Low 2.9 Apache Camel issue on ExchangeCreatedEvent 0.7%
• CVE-2024-23114 Critical 9.8 Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository 1.3%
• CVE-2024-22369 High 7.8 Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository 0.7%