What’s Vulnerable › Products

Apache Software Foundation Apache Camel vulnerabilities

126 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 108 published in the last 12 months.

Check whether your Apache Software Foundation Apache Camel version is affected

Latest Apache Software Foundation Apache Camel vulnerabilities

• CVE-2026-94386 — Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache (CVSS 4.8)
• CVE-2026-90885 — Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved (CVSS 7.5)
• CVE-2026-95664 — Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions (CVSS 5.4)
• CVE-2026-95663 — Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry (CVSS 4.8)
• CVE-2026-95629 — Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory (CVSS 5.4)
• CVE-2026-95628 — Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) (CVSS 5.4)
• CVE-2026-101259 — Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3)
• CVE-2026-88900 — Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution (CVSS 8.8)
• CVE-2026-91858 — Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present (CVSS 6.5)
• CVE-2026-88901 — Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default (CVSS 8.2)
• CVE-2026-85317 — Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache (CVSS 4.8)
• CVE-2026-85316 — Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching (CVSS 4.8)
• CVE-2026-85315 — Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3)
• CVE-2026-85314 — Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) (CVSS 6.5)
• CVE-2026-85313 — Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set (CVSS 4.3)
• CVE-2026-85312 — Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header (CVSS 4.8)
• CVE-2026-85301 — Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim (CVSS 4.8)
• CVE-2026-85300 — Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions (CVSS 5.5)
• CVE-2026-85296 — Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State (CVSS 6.5)
• CVE-2026-85260 — Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default (CVSS 5.5)
• CVE-2026-85257 — Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3)
• CVE-2026-85254 — Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing (CVSS 6.5)
• CVE-2026-85251 — Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets (CVSS 7.5)
• CVE-2026-85250 — Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option (CVSS 7.5)
• CVE-2026-85249 — Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata (CVSS 6.5)