Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Apache Camel patches four medium flaws in 4.18.5 and 4.22.2

1 source · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Four medium Apache Camel flaws disclosed October 23 are fixed in 4.18.5 and 4.22.2, with no exploitation reported.

Andrea Cosentino disclosed four medium-severity Apache Camel issues on October 23, 2026, through oss-security. Two camel-docling flaws, CVE-2026-95628 and CVE-2026-95629, are path-traversal bugs scored CVSS 3.1 5.4; the first is an incomplete fix of CVE-2026-40047 that fails to reject absolute custom CLI paths, and the second lets a low-privileged caller write conversion output to an arbitrary directory. CVE-2026-95664, also 5.4, lets untrusted CamelAwsS3Key values be evaluated as Simple expressions in camel-aws2-s3. CVE-2026-101259, scored 5.3, can expose sensitive data through unmuted camel-coap consumer exceptions to unauthenticated remote users. Fixes are 4.18.5 and 4.22.2; the notices do not mention exploitation.

Key facts
  • CVE-2026-95628 and CVE-2026-95629 affect camel-docling 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2.
  • CVE-2026-95628 is described as an incomplete fix of CVE-2026-40047.
  • CVE-2026-95664 affects camel-aws2-s3 from 4.8.0 before 4.18.5 and 4.19.0 before 4.22.2.
  • CVE-2026-101259 affects camel-coap from 4.0.0 before 4.18.5 and 4.19.0 before 4.22.2, CVSS 5.3.
  • Docling and AWS2-S3 issues are CVSS 3.1 5.4 and require low privileges.
  • None of the truncated notices say the flaws are exploited.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026Four Apache Camel flaws disclosed by Andrea Cosentino · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityCVE-2026-95628 does not reject absolute custom CLI paths.
  • oss-securityCVE-2026-95629 writes conversion output via an unvalidated header.
  • oss-securityCVE-2026-95664 evaluates CamelAwsS3Key values as Simple expressions.
  • oss-securityCVE-2026-101259 can leak data through unmuted CoAP exceptions.
CVEs
CVE-2026-95664CVE-2026-101259CVE-2026-95629CVE-2026-95628
Vendors
Apache
Products
Apache Camelcamel-aws2-s3camel-coapcamel-docling

Coverage

oldest first · one row per article · UTC
  1. · 7d ago oss-securityFirst report

    Camel Docling still accepts absolute CLI paths (CVE-2026-95628)

    Path checks added after CVE-2026-40047 do not reject absolute paths supplied as custom CLI arguments.

  2. · 7d ago oss-security

    Camel Docling output path header allows arbitrary writes (CVE-2026-95629)

    A low-privileged caller can steer conversion output to an arbitrary directory through an unvalidated header.

  3. · 7d ago oss-security

    Camel AWS2-S3 treats untrusted keys as expressions (CVE-2026-95664)

    A low-privileged attacker can inject expressions through the CamelAwsS3Key header; the CVSS score is 5.4.

  4. · 7d ago oss-security

    Apache Camel CoAP can leak data in error messages (CVE-2026-101259)

    Unmuted consumer exceptions in camel-coap can expose sensitive information to unauthenticated remote users; CVSS is 5.3.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-95628
+3 related CVEs
CVE-2026-95629CVE-2026-95664CVE-2026-101259
Path Traversal in Apache Camel Docling before 4.23.0
5.4
group max
—