Read the docs
TI-2014-00003 Aliases CVE-2014-0003GHSA-h6rp-8v4j-hwph

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and…

Priority MEDIUM 43CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264 and CWE-502.

Summary

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

Why it matters now

EPSS 0.07492 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.camel:camel-core (Maven): 2.11.4, 2.12.3Red Hat: 7 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.camel:camel-core (Maven)2.11.0 to before 2.11.42.11.4Patch availableGHSA-h6rp-8v4j-hwph
—org.apache.camel:camel-core (Maven)2.12.0 to before 2.12.32.12.3Patch availableGHSA-h6rp-8v4j-hwph
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.camel:camel-core (Maven) Vendor— Affected 2.11.0 to before 2.11.4 Fixed in 2.11.4 Patch available GHSA-h6rp-8v4j-hwph
  • org.apache.camel:camel-core (Maven) Vendor— Affected 2.12.0 to before 2.12.3 Fixed in 2.12.3 Patch available GHSA-h6rp-8v4j-hwph

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*up to 2.11.3VulnerableApache
cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableApache
cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableApache
cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableApache
cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableApache
cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableApache
cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableApache
cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions up to 2.11.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Apache
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableApache
cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*2.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*2.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*2.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableApache
cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableApache
cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*2.10.2VulnerableApache
cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*2.10.3VulnerableApache
cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*2.10.4VulnerableApache
cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*2.10.5VulnerableApache
cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*2.10.6VulnerableApache
cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*2.10.7VulnerableApache
cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableApache
cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*2.11.1VulnerableApache
cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*2.11.2VulnerableApache
cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableApache
cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*2.12.1VulnerableApache
cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*2.12.2VulnerableApache
  • cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:* Versions 2.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:* Versions 2.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:* Versions 2.10.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:* Versions 2.10.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:* Versions 2.10.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:* Versions 2.10.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:* Versions 2.10.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:* Versions 2.10.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:* Versions 2.11.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:* Versions 2.11.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:* Versions 2.12.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:* Versions 2.12.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-h6rp-8v4j-hwph org.apache.camel:camel-core (Maven) Fixed in 2.11.4 Advisory →
  • Fix · GHSA-h6rp-8v4j-hwph org.apache.camel:camel-core (Maven) Fixed in 2.12.3 Advisory →

Red Hat 7 advisories

  • RHSA-2014:0459 Released 2014-04-30 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2014:0452 Released 2014-04-30 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0
  • RHSA-2014:0372 Released 2014-04-03 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.1 update
    • Red Hat JBoss BRMS 6.0
Show 4 more Red Hat advisories
  • RHSA-2014:0371 Released 2014-04-03 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.1 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2014:0323 Released 2014-03-24 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.0.0 security update
    • Red Hat JBoss A-MQ 6.0
    • Red Hat JBoss Fuse 6.0
  • RHSA-2014:0254 Released 2014-03-05 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 1.2 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • Red Hat OpenShift Enterprise Node activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
  • RHSA-2014:0245 Released 2014-03-03 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • RHOSE Node 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fuse ESB Enterprise 7.1.0Fixed RHSA-2014:0452
Fuse MQ Enterprise 7.1.0Fixed RHSA-2014:0452
Fuse Management Console 7.1.0Fixed RHSA-2014:0452
RHOSE Infrastructure 1.2Fixed RHSA-2014:0254
RHOSE Infrastructure 2.0Fixed RHSA-2014:0245
RHOSE Node 2.0Fixed RHSA-2014:0245
Red Hat JBoss A-MQ 6.0Fixed RHSA-2014:0323
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:0371
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0372
Red Hat JBoss Fuse 6.0Fixed RHSA-2014:0323
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:0459
Red Hat OpenShift Enterprise NodeFixed RHSA-2014:0254

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0003
  2. 2026-10-03 Alias added: GHSA-h6rp-8v4j-hwph

References

Exploit 1

Advisory 5

Other 10

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences