Skip to content
OpenAdvisories
High NCSC-2026-0129 8 CVEs

Kwetsbaarheden verholpen in Apache Camel

Published Apr 29, 2026 · Updated Apr 29, 2026 · nl

Vendor: Apache Vendor: Apache Software Foundation Product: Apache Camel Product: Apache Camel CoAP Product: Apache Camel Google PubSub Product: Apache Camel JMS Product: Apache Camel Mina Product: Apache Camel Platform HTTP Main Product: Apache Camel PQC Product: Camel

Summary

Apache Software Foundation heeft kwetsbaarheden verholpen in Apache Camel.

Details

Interpretaties
De kwetsbaarheden bevinden zich in verschillende componenten van Apache Camel. De problemen betreffen onder andere onveilige deserialisatie, onvoldoende filtering van e-mailheaders, onjuiste authenticatiepadmatching, en onjuiste verwerking van interne headers. De meest ernstige kwetsbaarheid stelt kwaadwillenden in staat om ongeauthenticeerd op afstand willekeurige code uit te voeren. De kwetsbaarheden zijn aanwezig in diverse versies van Apache Camel, met name vanaf versie 3.0.0 tot net voor de gepatchte versies 4.14.6, 4.14.7, 4.18.1, 4.18.2, 4.19.0 en 4.20.0, afhankelijk van de component. De fixes omvatten onder meer het toepassen van veilige deserialisatie, correcte filtering van headers, en verbeterde authenticatiecontroles.

Oplossingen
Apache Software Foundation heeft updates uitgebracht in Apache Camel versies 4.14.6, 4.14.7, 4.18.1, 4.18.2, 4.19.0 en 4.20.0 om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 8

  • Critical 9.9
    CVE-2026-40453 Public exploit

    Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

    The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to…

    Apache Software Foundation Apache Camel CoAP Apache Camel JMS Apache Camel Google PubSub Maven
  • Critical 9.8
    CVE-2026-40860 Public exploit

    Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

    JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or c…

    Apache Software Foundation Apache Camel org.apache.camel:camel-sjms org.apache.camel:camel-jms Maven
  • Critical 9.4
    CVE-2026-33454 Public exploit

    Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

    The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' dire…

    Apache Software Foundation Apache Camel org.apache.camel:camel-mail Maven
  • High 8.8
    CVE-2026-27172 Public exploit

    Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

    The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject…

    Apache Software Foundation Apache Camel org.apache.camel:camel-consul Maven
  • High 8.8
    CVE-2026-40473 Public exploit

    Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

    The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer …

    Apache Software Foundation Apache Camel Mina org.apache.camel:camel-mina Maven
  • High 8.8
    CVE-2026-40858 Public exploit

    Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

    The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache us…

    Apache Software Foundation Apache Camel org.apache.camel:camel-infinispan Maven
  • High 8.2
    CVE-2026-40022 Public exploit

    Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

    When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenti…

    Apache Software Foundation Apache Camel Platform HTTP Main org.apache.camel:camel-platform-http-main Maven
  • High 7.8
    CVE-2026-40048 Public exploit

    Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

    The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.…

    Apache Software Foundation Apache Camel PQC org.apache.camel:camel-pqc Maven

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://camel.apache.org/security/CVE-2026-27172.html
  • Reference
    https://camel.apache.org/security/CVE-2026-33453.html
  • Reference
    https://camel.apache.org/security/CVE-2026-33454.html
  • Reference
    https://camel.apache.org/security/CVE-2026-40022.html
  • Reference
    https://camel.apache.org/security/CVE-2026-40048.html
  • Reference
    https://camel.apache.org/security/CVE-2026-40453.html
  • Reference
    https://camel.apache.org/security/CVE-2026-40473.html
  • Reference
    https://camel.apache.org/security/CVE-2026-40858.html
  • Reference
    https://camel.apache.org/security/CVE-2026-40860.html