Apache Camel patches XXE, deserialization, and credential flaws
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
1
Stories per day · 30 days
Relateddeserialization4camel-docling2java2oauth2path-traversal2xml2xxe2access-tokens1apache1authentication-bypass1aws-s31camel-aws2-s31camel-coap1camel-k1camel-keycloak1camel-oauth1camel-saxon1coap1
9 stories, newest first · one card per story
Stories tagged #apache-camel
Apache Camel flaws allow remote code execution and data theft
Eight critical and high issues span Camel K and Camel components, with fixes that differ by branch.
1
Camel AWS2-S3 treats untrusted keys as expressions (CVE-2026-95664)
A low-privileged attacker can inject expressions through the CamelAwsS3Key header; the CVSS score is 5.4.
Apache Camel OAuth cache reuses tokens across scopes (CVE-2026-94386)
camel-oauth from 4.19.0 before 4.22.2 can reuse client-credentials bearer tokens; CVSS 3.1 is 4.8.
Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)
camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.
Apache Camel JGroups deserializes cluster messages to RCE
CVE-2026-88900 scores CVSS 8.8; fixed builds are 4.18.5 and 4.22.1.
Apache Camel fixes 38 CVEs in 4.18.5, 4.22.1 and 4.23.0
The 4.14.x line is end of life and does not receive these fixes.
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann backs splitting oss-security so Apache CVE floods do not bury the main list.
CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Apache Camel Quarkus CVE-2026-88789 forces Xalan and drops external DTD and stylesheet hardening.