Improper input validation in Apache Camel
Priority MEDIUM 48CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Why it matters now
EPSS 0.13959 96th percentileScored 2026-11-08
Fix Partial org.apache.camel:camel (Maven): 3.2.0org.apache.camel:camel-core (Maven): 3.2.0+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Camel | Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 | — | No fix listed | CNA |
| — | org.apache.camel:camel (Maven) | before 3.2.0 | 3.2.0 | Patch available | GHSA-hfg5-xpvw-c9x4 |
| — | org.apache.camel:camel-core (Maven) | before 3.2.0 | 3.2.0 | Patch available | GHSA-hfg5-xpvw-c9x4 |
| — | org.apache.camel:camel-management (Maven) | before 3.2.0 | 3.2.0 | Patch available | GHSA-hfg5-xpvw-c9x4 |
- Apache Camel Vendor— Affected Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 Fixed in — No fix listed CNA
- org.apache.camel:camel (Maven) Vendor— Affected before 3.2.0 Fixed in 3.2.0 Patch available GHSA-hfg5-xpvw-c9x4
- org.apache.camel:camel-core (Maven) Vendor— Affected before 3.2.0 Fixed in 3.2.0 Patch available GHSA-hfg5-xpvw-c9x4
- org.apache.camel:camel-management (Maven) Vendor— Affected before 3.2.0 Fixed in 3.2.0 Patch available GHSA-hfg5-xpvw-c9x4
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 2.22.0 – 3.1.0 | Vulnerable | Apache |
| cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* | 8.0.0 – 8.1.0; 8.2.0 – 8.2.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* | 13.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* | 13.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 2.22.0 – 3.1.0 Vulnerable ·Apache
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.1.0; 8.2.0 – 8.2.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* Versions 13.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-hfg5-xpvw-c9x4 org.apache.camel:camel (Maven) Fixed in 3.2.0 Advisory →
- Fix · GHSA-hfg5-xpvw-c9x4 org.apache.camel:camel-core (Maven) Fixed in 3.2.0 Advisory →
- Fix · GHSA-hfg5-xpvw-c9x4 org.apache.camel:camel-management (Maven) Fixed in 3.2.0 Advisory →
Red Hat 1 advisory
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11971
- 2026-10-03 Alias added: GHSA-hfg5-xpvw-c9x4
References
Patch 3
Advisory 3
Other 23
- [camel-commits] 20200522 [camel-website] 01/02: CVE-2020-11971 - Amend the fix version
- [camel-commits] 20200522 [camel-website] branch CVE-2020-11971-amend created (now 2a753f7)
- [camel-commits] 20200522 [camel-website] 02/02: CVE-2020-11971 - Amended fix version
- [activemq-issues] 20200601 [jira] [Created] (AMQ-7492) CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
- [activemq-issues] 20200622 [jira] [Commented] (AMQ-7492) CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
- [activemq-issues] 20200622 [jira] [Assigned] (AMQ-7492) CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
- [activemq-issues] 20201122 [jira] [Commented] (AMQ-7492) CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
- [activemq-issues] 20201122 [jira] [Updated] (AMQ-7492) CVE-2020-11971 needs AMQ to upgrade to Apache Camel 2.25.2
- [activemq-users] 20210830 Security issues
- [activemq-users] 20210831 RE: Security issues
- https://github.com/apache/camel/commit/b954402272ddcfbb45dc1495520f920e70cc041c
- https://lists.apache.org/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9@%3Ccommits.camel.apache.org%3E
- https://issues.apache.org/jira/browse/CAMEL-14811
- https://github.com/apache/camel
Sources
- CVE-2020-11971 · CVE Program
- CVE-2020-11971 · NVD
- FIRST EPSS
- GHSA-hfg5-xpvw-c9x4 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-11971 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences