Skip to content
OpenAdvisories
High WID-SEC-2026-1271 8 CVEs

Apache Camel: Mehrere Schwachstellen

Published Apr 26, 2026 · Updated Oct 19, 2026 · Revision 7 · de-DE

Vendor: Apache Vendor: Red Hat Product: Camel Product: Enterprise Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Apache Camel ist ein Integrations-Framework, das Enterprise Integration Patterns implementiert.

Vulnerabilities 8

  • Critical 9.9
    CVE-2026-40453 Public exploit

    Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

    The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to…

    Apache Software Foundation Apache Camel CoAP Apache Camel JMS Apache Camel Google PubSub Maven
  • Critical 9.8
    CVE-2026-40860 Public exploit

    Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

    JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or c…

    Apache Software Foundation Apache Camel org.apache.camel:camel-sjms org.apache.camel:camel-jms Maven
  • Critical 9.4
    CVE-2026-33454 Public exploit

    Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

    The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' dire…

    Apache Software Foundation Apache Camel org.apache.camel:camel-mail Maven
  • High 8.8
    CVE-2026-27172 Public exploit

    Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

    The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject…

    Apache Software Foundation Apache Camel org.apache.camel:camel-consul Maven
  • High 8.8
    CVE-2026-40473 Public exploit

    Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

    The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer …

    Apache Software Foundation Apache Camel Mina org.apache.camel:camel-mina Maven
  • High 8.8
    CVE-2026-40858 Public exploit

    Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

    The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache us…

    Apache Software Foundation Apache Camel org.apache.camel:camel-infinispan Maven
  • High 8.2
    CVE-2026-40022 Public exploit

    Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

    When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenti…

    Apache Software Foundation Apache Camel Platform HTTP Main org.apache.camel:camel-platform-http-main Maven
  • High 7.8
    CVE-2026-40048 Public exploit

    Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

    The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.…

    Apache Software Foundation Apache Camel PQC org.apache.camel:camel-pqc Maven

Revision history

  1. #7

    Referenz(en) aufgenommen: EUVD-2026-104244

  2. #6

    Referenz(en) aufgenommen: EUVD-2026-41834

  3. #5

    Neue Updates von Red Hat aufgenommen

  4. #4

    Neue Updates von Red Hat aufgenommen

  5. #3

    Neue Updates von Red Hat aufgenommen

  6. #2

    Referenz(en) aufgenommen: EUVD-2026-25808, EUVD-2026-25806, EUVD-2026-25790, EUVD-2026-25794, EUVD-2026-25807

  7. #1

    Initiale Fassung

References