Apache

Camel

86 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2026-40858

  • EPSS 0.93%
  • Veröffentlicht 27.04.2026 09:38:55
  • Zuletzt bearbeitet 09.09.2026 13:19:51

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan...

9.9

CVE-2026-40453

Medienbericht
  • EPSS 1.55%
  • Veröffentlicht 27.04.2026 08:23:20
  • Zuletzt bearbeitet 15.07.2026 02:21:05

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not a...

9.8

CVE-2026-40860

  • EPSS 1.24%
  • Veröffentlicht 27.04.2026 08:03:19
  • Zuletzt bearbeitet 09.09.2026 13:19:51

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allow...

7.8

CVE-2026-40048

  • EPSS 0.25%
  • Veröffentlicht 27.04.2026 07:53:54
  • Zuletzt bearbeitet 15.07.2026 02:21:02

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java....

8.8

CVE-2026-40473

  • EPSS 0.87%
  • Veröffentlicht 27.04.2026 07:51:59
  • Zuletzt bearbeitet 15.07.2026 02:21:06

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP ...

8.8

CVE-2026-25747

Exploit
  • EPSS 0.9%
  • Veröffentlicht 23.02.2026 08:45:45
  • Zuletzt bearbeitet 17.08.2026 12:17:31

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any O...

9.1

CVE-2026-23552

Exploit
  • EPSS 0.43%
  • Veröffentlicht 23.02.2026 08:45:36
  • Zuletzt bearbeitet 26.02.2026 16:46:16

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keyc...

5.3

CVE-2025-66169

  • EPSS 0.62%
  • Veröffentlicht 14.01.2026 11:45:20
  • Zuletzt bearbeitet 16.01.2026 14:29:11

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS...

6.5

CVE-2025-30177

  • EPSS 1.16%
  • Veröffentlicht 01.04.2025 12:15:15
  • Zuletzt bearbeitet 15.04.2025 13:00:12

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10...

4.8

CVE-2025-29891

Exploit
  • EPSS 75.13%
  • Veröffentlicht 12.03.2025 14:42:59
  • Zuletzt bearbeitet 02.04.2025 20:37:07

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS a...