Apache Camel CoAP can leak data in error messages (CVE-2026-101259)
Original title: CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
Unmuted consumer exceptions in camel-coap can expose sensitive information to unauthenticated remote users; CVSS is 5.3.
Andrea Cosentino reported an information-disclosure flaw in the Apache Camel CoAP component. Error messages generated from unmuted consumer exceptions can contain sensitive information. It affects camel-coap from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. The posted description is cut off, and no exploitation is mentioned.
Unconfirmed: The advisory is truncated after "When," so the exact trigger is not fully stated.
- CVSS 3.1 is 5.3: network, low complexity, no privileges and no user interaction.
- Impact is limited to low confidentiality, with no integrity or availability effect.
- The affected artifact is org.apache.camel:camel-coap.
Impact: Unauthenticated remote disclosure of sensitive error information
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-coap | 4.0.0 before 4.18.5; 4.19.0 before 4.22.2 | 4.18.5, 4.22.2 |
- 1.Upgrade org.apache.camel:camel-coap to 4.18.5 or 4.22.2.
- CVEs
- CVE-2026-101259
- Vendors
- Apache
- Products
- Apache Camelcamel-coap
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101259 | Information Disclosure in Apache Camel CoAP Consumer | 5.3 | — |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.