Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Priority MEDIUM 50CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Why it matters now
EPSS 0.05448 92nd percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-core (Maven): 2.20.4, 2.21.1Red Hat: 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 2.20.0 to 2.20.3; 2.21.0 | — | No fix listed | CNA |
| — | org.apache.camel:camel-core (Maven) | 2.20.0 to before 2.20.4 | 2.20.4 | Patch available | GHSA-8vfm-4388-6rpc |
| — | org.apache.camel:camel-core (Maven) | 2.21.0 to before 2.21.1 | 2.21.1 | Patch available | GHSA-8vfm-4388-6rpc |
- Apache Camel VendorApache Affected 2.20.0 to 2.20.3; 2.21.0 Fixed in — No fix listed CNA
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.20.0 to before 2.20.4 Fixed in 2.20.4 Patch available GHSA-8vfm-4388-6rpc
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.21.0 to before 2.21.1 Fixed in 2.21.1 Patch available GHSA-8vfm-4388-6rpc
Remediation
- Fix · GHSA-8vfm-4388-6rpc org.apache.camel:camel-core (Maven) Fixed in 2.20.4 Advisory →
- Fix · GHSA-8vfm-4388-6rpc org.apache.camel:camel-core (Maven) Fixed in 2.21.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
Not affected: 4 products
- JBoss Developer Studio 11
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss SOA Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8027
- 2026-10-03 Alias added: GHSA-8vfm-4388-6rpc
References
Advisory 3
Other 21
- [camel-dev] 20180731 [SECURITY] New security advisory CVE-2018-8027 released for Apache Camel
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb
- https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5
- https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41
- https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b
- https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d
- https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0
- https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0
- https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b
- https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a
- https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b
- https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9
- https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-10894
- https://issues.apache.org/jira/browse/CAMEL-12444
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-8027 · CVE Program
- CVE-2018-8027 · NVD
- FIRST EPSS
- GHSA-8vfm-4388-6rpc · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8027 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences