Apache Camel patches XXE, deserialization, and credential flaws
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
62
Product
Apache Camel
- Mentions · 7d2
- Mentions · 30d12
- All mentions12
- First seenOct 17, 2026
- Last mentioned3d ago
Timeline
12 articles · newest firstApache Camel flaws allow remote code execution and data theft
Eight critical and high issues span Camel K and Camel components, with fixes that differ by branch.
64
Apache Camel CoAP can leak data in error messages (CVE-2026-101259)
Unmuted consumer exceptions in camel-coap can expose sensitive information to unauthenticated remote users; CVSS is 5.3.
48
Camel AWS2-S3 treats untrusted keys as expressions (CVE-2026-95664)
A low-privileged attacker can inject expressions through the CamelAwsS3Key header; the CVSS score is 5.4.
50
Camel Keycloak accepts expired tokens from unbounded cache (CVE-2026-95663)
Cached introspection results are not limited by token expiry, so expired access tokens can still be accepted.
42
Camel Docling output path header allows arbitrary writes (CVE-2026-95629)
A low-privileged caller can steer conversion output to an arbitrary directory through an unvalidated header.
44
Camel Docling still accepts absolute CLI paths (CVE-2026-95628)
Path checks added after CVE-2026-40047 do not reject absolute paths supplied as custom CLI arguments.
44
Apache Camel OAuth cache reuses tokens across scopes (CVE-2026-94386)
camel-oauth from 4.19.0 before 4.22.2 can reuse client-credentials bearer tokens; CVSS 3.1 is 4.8.
48
Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)
camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.
58
Apache Camel JGroups deserializes cluster messages to RCE
CVE-2026-88900 scores CVSS 8.8; fixed builds are 4.18.5 and 4.22.1.
62
Apache Camel fixes 38 CVEs in 4.18.5, 4.22.1 and 4.23.0
The 4.14.x line is end of life and does not receive these fixes.
64
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann backs splitting oss-security so Apache CVE floods do not bury the main list.
20
Related CVEs
by mentions- CVE-2026-88900<1%8.8Unsafe Java deserialization RCE in Apache Camel JGroups
- Untrusted Java deserialization in Apache Camel Spring Redis
- XXE in Apache Camel Smooks default XML reader
- CVE-2026-90885<1%7.5XXE in Apache Camel Saxon when body is already a Source
- Credential leak on redirect in Apache Camel HTTP
- CVE-2026-78162<1%10.0Unrestricted Java deserialization RCE in Apache Camel Hazelcast
- YAML injection in Apache Camel K lets CR authors create objects with operator privileges
- CVE-2026-78164<1%8.2Template injection and info leak in Apache Camel HTTP producers
- XXE in Apache Camel XPath when documentType is InputSource
- Information Disclosure in Apache Camel CoAP Consumer
Appears with
- Apachevendor · 11
- camel-jgroupsproduct · 2
- camel-saxonproduct · 2
- camel-doclingproduct · 2
- Camel-Smooksproduct · 1
- camel-coapproduct · 1
- Camel-Hazelcastproduct · 1
- Apache Software Foundationorganization · 1
- camel-aws2-s3product · 1
- camel-keycloakproduct · 1
- Camel Kproduct · 1
- Apache Camel PMCorganization · 1
- Camel-HTTPproduct · 1
- Camel-FOPproduct · 1
- Camel-Spring-Redisproduct · 1
- camel-oauthproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.