Apache Camel issue on ExchangeCreatedEvent
Priority LOW 34CWE-922Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-922.
Summary
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00695 53rd percentileScored 2026-11-07
Fix Partial Apache Camel (Apache Software Foundation): 1.xorg.apache.camel:camel-core (Maven): 3.21.4, 3.22.1, 4.0.4 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 3.21.x – 3.21.3; 3.22.x – 3.22.0; 4.0.x – 4.0.3; 4.x – 4.3.0 | 1.x | Patch available | CNA |
| — | org.apache.camel:camel-core (Maven) | 3.0.0 to before 3.21.4 | 3.21.4 | Patch available | GHSA-qpxm-689r-3849 |
| — | org.apache.camel:camel-core (Maven) | 3.22.0 to before 3.22.1 | 3.22.1 | Patch available | GHSA-qpxm-689r-3849 |
| — | org.apache.camel:camel-core (Maven) | 4.0.0 to before 4.0.4 | 4.0.4 | Patch available | GHSA-qpxm-689r-3849 |
| — | org.apache.camel:camel-core (Maven) | 4.1.0 to before 4.4.0 | 4.4.0 | Patch available | GHSA-qpxm-689r-3849 |
- Apache Camel VendorApache Affected 3.21.x – 3.21.3; 3.22.x – 3.22.0; 4.0.x – 4.0.3; 4.x – 4.3.0 Fixed in 1.x Patch available CNA
- org.apache.camel:camel-core (Maven) Vendor— Affected 3.0.0 to before 3.21.4 Fixed in 3.21.4 Patch available GHSA-qpxm-689r-3849
- org.apache.camel:camel-core (Maven) Vendor— Affected 3.22.0 to before 3.22.1 Fixed in 3.22.1 Patch available GHSA-qpxm-689r-3849
- org.apache.camel:camel-core (Maven) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-qpxm-689r-3849
- org.apache.camel:camel-core (Maven) Vendor— Affected 4.1.0 to before 4.4.0 Fixed in 4.4.0 Patch available GHSA-qpxm-689r-3849
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 3.0.0 to before 3.21.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:*:-:*:*:*:*:*:* | 4.0.0 to before 4.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 4.1.0 to before 4.4.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:3.22.0:*:*:*:*:*:*:* | 3.22.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.21.4 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:*:-:*:*:*:*:*:* Versions 4.0.0 to before 4.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.4.0 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:3.22.0:*:*:*:*:*:*:* Versions 3.22.0 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 1.x
- Fix · GHSA-qpxm-689r-3849 org.apache.camel:camel-core (Maven) Fixed in 3.21.4 Advisory →
- Fix · GHSA-qpxm-689r-3849 org.apache.camel:camel-core (Maven) Fixed in 3.22.1 Advisory →
- Fix · GHSA-qpxm-689r-3849 org.apache.camel:camel-core (Maven) Fixed in 4.0.4 Advisory →
- Fix · GHSA-qpxm-689r-3849 org.apache.camel:camel-core (Maven) Fixed in 4.4.0 Advisory →
Red Hat 1 advisory
- RHSA-2024:4057 Released 2024-06-24 · Red Hat rating ImportantRelease of OpenShift Serverless Logic 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.33 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +6
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Serverless 1.33 | Fixed | RHSA-2024:4057 |
Not affected: 7 products
- OpenShift Serverless
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22371
- 2026-10-03 Alias added: GHSA-qpxm-689r-3849
References
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-22371 · CVE Program
- CVE-2024-22371 · NVD
- FIRST EPSS
- GHSA-qpxm-689r-3849 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-22371 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences