CVE Vulnerability Catalog

A vulnerability in the Apache Camel Mina component causes sensitive exception details to be sent back to the remote peer when exchange processing fails. Depending on the codec (textline or object), the peer may receive class names, messages, or even the serialized exception with its cause chain, potentially exposing paths, host names, and connection details. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in the Apache Camel Thrift component causes incoming data to be unmarshalled into the shared defaultInstance of the target type rather than a fresh copy. As a result, state from one message remains visible to subsequent messages of the same type, potentially leading to data disclosure between different senders.

Improper validation of the integrity check value in Apache Camel Crypto PGP component. The unmarshal() method verified the modification detection code only for OpenPGP symmetrically encrypted integrity protected data packets, skipping the check for older packets without such code, allowing the sender or a man-in-the-middle to decide whether integrity protection applied.

A vulnerability in the Apache Camel Shiro component skips credential verification when the subject already bound to the current thread carries the same principal as the incoming exchange. Because threads are pooled and reused, a subject left bound by an earlier authenticated exchange can satisfy the check for a later exchange that presents no valid credentials.

A vulnerability in the Apache Camel Knative component causes sensitive exception details to be disclosed in the HTTP response returned to the remote caller. When exchange processing failed on the consumer side, the response body included the exception's class name, message, and stack trace. An external sender could provoke a failure and read internal deployment details such as class and package names, file system or host names, and route structure.

A Cross-Site Request Forgery (CSRF) vulnerability in the Apache Camel OAuth component stems from the authorization code callback not binding or verifying a state parameter tied to the initiating session. An authorization code obtained in any browser could be redeemed at the callback and associated with the presenting session, enabling login CSRF. The same unvalidated callback handling also allowed the post-authentication redirect target to be influenced, resulting in an open redirect from a trusted origin.

A vulnerability in the Apache Camel Platform HTTP Vertx component involves improper CORS handling: the Access-Control-Allow-Credentials: true header is sent regardless of the origin check result, and when camel.server.cors.origins is unset the handler reflects any origin in Access-Control-Allow-Origin. As a result, any page can make credentialed cross-origin requests to the Camel endpoint and read the responses.

A Code Injection and Expression Language Injection vulnerability in Apache Camel (versions 4.4.0–4.18.4, 4.19.0–4.22.0) affects the dynamic-router-control endpoint. DynamicRouterControlProducer took the subscription predicate and expression language name from the incoming message (body fields or CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers) and compiled them without an allow-list or opt-in. This allowed arbitrary expressions to be evaluated with the privileges of the Camel process.

The AS2 component in Apache Camel (versions 4.0.0–4.18.4 and 4.19.0–4.22.0) lets the message sender choose the asynchronous MDN notification address that Camel then connects to. This results in SSRF from the AS2 receiver's position, including reaching hosts routable only from the internal network, and configured MDN credentials may be exposed to the attacker.

The Netty HTTP component in Apache Camel (versions 4.0.0–4.18.4 and 4.19.0–4.22.0) compares the request path against the security context path case-sensitively, while routing does not. Changing the case of a path segment bypasses the security constraint and reaches the protected route without satisfying it.

A vulnerability in the Apache Camel OAuth component causes camel-oauth processors guarding a route to not stop the exchange when authentication cannot be completed. As a result, an unauthenticated caller can reach the protected endpoint as though authentication had succeeded (fail-open). This affects Apache Camel from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel Azure Files component builds remote file paths by concatenating the configured directory with the file name from the server's directory listing, without lexical normalization or a containment check. As a result, Camel can read, delete, or rename files outside the configured polling directory using the endpoint's own credentials. The issue affects Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel SMB component allows reading, deleting, or renaming files outside the configured remote directory. This is due to missing normalization and containment checks when concatenating the directory with a file name from the server's listing. The issue affects Apache Camel versions from 4.2.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel Mina SFTP component allows escaping the configured remote directory when retrieving, deleting, or renaming files. The file name from the server listing is not normalized or checked for containment within the directory, enabling an on-path attacker or malicious server to supply a name with parent-directory segments. The issue affects Apache Camel versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel FTP component allows reading, deleting, or renaming files outside the configured remote directory. This is due to missing normalization and containment checks when concatenating the directory with the file name from the server's listing. It affects versions 4.0.0–4.18.4, 4.19.0–4.22.0, and the ftp, ftps, and sftp schemes.

Deserialization of untrusted data vulnerability in the Apache Camel Spring Redis component. When no serializer was configured, the component defaulted to JdkSerializationRedisSerializer without an ObjectInputFilter, allowing code execution via crafted data in Redis. Affects versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components allows an inbound message sender to override the endpoint URI via the CamelHttpUri and CamelRestHttpUri headers, after which property placeholders in that string are resolved (environment variables, system properties, secret functions, bean invocations). This can lead to exposure of sensitive information and unexpected bean method invocation. The issue affects Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in the Apache Camel Docling component allows implicit selection of message body processing mode based on its prefix (http://, https://, / or \), enabling SSRF, path traversal and exposure of sensitive information. The lack of an option to pin the mode and insufficient path validation allow access to remote resources or local files without deployment opt-in.

A deserialization of untrusted data vulnerability in Apache Camel affects the camel-hazelcast component. Two configuration paths (ReplicatedHazelcastAggregationRepository and client mode in HazelcastDefaultComponent) fail to apply the JavaSerializationFilterConfig, allowing an attacker to achieve remote code execution by injecting a malicious Java object into the Hazelcast cluster.

Apache Johnzon is affected by an Unsafe Reflection vulnerability — ClassConverter loads and static-initializes an attacker-named class from untrusted JSON. The issue affects versions from 1.0.0 before 2.2.0.