Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Priority MEDIUM 41CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Why it matters now
EPSS 0.05863 93rd percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-core (Maven): 2.17.6, 2.18.2Red Hat: 1 advisoryRed Hat: 2 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 2.17.0 to 2.17.5; 2.18.0 to 2.18.2; The unsupported Camel 2.x (2.16 and earlier) versions may be also affected. | — | No fix listed | CNA |
| — | org.apache.camel:camel-core (Maven) | before 2.17.6 | 2.17.6 | Patch available | GHSA-vq9j-jh62-5hmp |
| — | org.apache.camel:camel-core (Maven) | 2.18.0 to before 2.18.2 | 2.18.2 | Patch available | GHSA-vq9j-jh62-5hmp |
- Apache Camel VendorApache Affected 2.17.0 to 2.17.5; 2.18.0 to 2.18.2; The unsupported Camel 2.x (2.16 and earlier) versions may be also affected. Fixed in — No fix listed CNA
- org.apache.camel:camel-core (Maven) Vendor— Affected before 2.17.6 Fixed in 2.17.6 Patch available GHSA-vq9j-jh62-5hmp
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.18.0 to before 2.18.2 Fixed in 2.18.2 Patch available GHSA-vq9j-jh62-5hmp
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | up to 2.16.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.0:*:*:*:*:*:*:* | 2.17.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.1:*:*:*:*:*:*:* | 2.17.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.2:*:*:*:*:*:*:* | 2.17.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.3:*:*:*:*:*:*:* | 2.17.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.4:*:*:*:*:*:*:* | 2.17.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.5:*:*:*:*:*:*:* | 2.17.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.18.0:*:*:*:*:*:*:* | 2.18.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.18.1:*:*:*:*:*:*:* | 2.18.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.18.2:*:*:*:*:*:*:* | 2.18.2 | Vulnerable | Apache |
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions up to 2.16.0 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.0:*:*:*:*:*:*:* Versions 2.17.0 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.1:*:*:*:*:*:*:* Versions 2.17.1 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.2:*:*:*:*:*:*:* Versions 2.17.2 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.3:*:*:*:*:*:*:* Versions 2.17.3 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.4:*:*:*:*:*:*:* Versions 2.17.4 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.5:*:*:*:*:*:*:* Versions 2.17.5 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.18.0:*:*:*:*:*:*:* Versions 2.18.0 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.18.1:*:*:*:*:*:*:* Versions 2.18.1 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.18.2:*:*:*:*:*:*:* Versions 2.18.2 Vulnerable ·Apache
Remediation
- Fix · GHSA-vq9j-jh62-5hmp org.apache.camel:camel-core (Maven) Fixed in 2.17.6 Advisory →
- Fix · GHSA-vq9j-jh62-5hmp org.apache.camel:camel-core (Maven) Fixed in 2.18.2 Advisory →
Red Hat 1 advisory
- RHSA-2017:1832 Released 2017-08-10 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:1832 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:1832 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5643
- 2026-10-03 Alias added: GHSA-vq9j-jh62-5hmp
References
Advisory 4
Other 9
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3be
- https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046da
- https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5b
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-10894
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-5643 · CVE Program
- CVE-2017-5643 · NVD
- FIRST EPSS
- GHSA-vq9j-jh62-5hmp · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5643 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences