Apache Software Foundation Apache Camel
42 CVEs affecting Apache Software Foundation Apache Camel. Latest disclosed: 2026-07-06. Critical: 18, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33453 | Critical | 10.0 | 2026-04-27 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap c… |
CVE-2026-48204 | Critical | 9.8 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects… |
CVE-2026-46456 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchan… |
CVE-2026-46455 | Critical | 9.8 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce… |
CVE-2026-46454 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Cam… |
CVE-2026-43867 | Critical | 9.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-47323 | Critical | 9.8 | 2026-05-19 | Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilter… |
CVE-2026-40860 | Critical | 9.8 | 2026-04-27 | JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values… |
CVE-2024-23114 | Critical | 9.8 | 2024-02-20 | Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Unde… |
CVE-2018-8027 | Critical | 9.8 | 2018-07-31 | Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor. |
CVE-2017-12634 | Critical | 9.8 | 2017-11-15 | The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializi… |
CVE-2017-12633 | Critical | 9.8 | 2017-11-15 | The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializ… |
CVE-2016-8749 | Critical | 9.8 | 2017-03-28 | Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. |
CVE-2017-3159 | Critical | 9.8 | 2017-03-07 | Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. |
CVE-2026-33454 | Critical | 9.4 | 2026-04-27 | The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) on… |
CVE-2026-48203 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSR… |
CVE-2026-40047 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling componen… |
CVE-2026-23552 | Critical | 9.1 | 2026-02-23 | Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate th… |
CVE-2026-46590 | High | 8.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-27172 | High | 8.8 | 2026-04-27 | The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)… |