Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Camel

97 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

88 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-33454 Public exploit

    Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

    The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' dire…

    Apache Software Foundation Apache Camel org.apache.camel:camel-mail Maven
  • High 8.8
    CVE-2026-40858 Public exploit

    Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

    The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache us…

    Apache Software Foundation Apache Camel org.apache.camel:camel-infinispan Maven
  • Critical 9.8
    CVE-2026-40860 Public exploit

    Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

    JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or c…

    Apache Software Foundation Apache Camel org.apache.camel:camel-jms org.apache.camel:camel-sjms Maven
  • Critical 9.1
    CVE-2026-23552 Public exploit

    Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

    Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm…

    Apache Software Foundation Apache Camel org.apache.camel:camel-keycloak Maven
  • Medium 5.6
    CVE-2025-27636 Public exploit EPSS 97%

    Apache Camel: Camel Message Header Injection via Improper Filtering

    Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10…

    Apache Software Foundation Apache Camel org.apache.camel:camel-support Maven
  • Low 2.9
    CVE-2024-22371 Public exploit

    Apache Camel issue on ExchangeCreatedEvent

    Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, …

    Apache Software Foundation Apache Camel org.apache.camel:camel-core Maven
  • High 7.8
    CVE-2024-22369 Public exploit

    Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository

    Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.…

    Apache Software Foundation Apache Camel org.apache.camel:camel-sql Maven
  • Medium 5.3
    CVE-2018-8041 Public exploit

    Apache Camel's Mail is vulnerable to path traversal

    Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.

    Apache Software Foundation Apache Camel org.apache.camel:camel-mail Maven