Read the docs
TI-2026-30810 Aliases CVE-2026-42527GHSA-8h6p-jvhf-9hcr

Deserialization of untrusted data in Apache Camel

Priority LOW 38CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. The class-level filter check passes because the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository). This issue affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not include javax.**).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00668 52nd percentileScored 2026-11-07
Fix Fixed Apache Camel (Apache Software Foundation): 4.14.8, 4.18.3, 4.21.0org.apache.camel:camel-jms (Maven): 4.14.8, 4.18.3, 4.21.0+11 more productsRed Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel4.14.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.04.14.8, 4.18.3, 4.21.0Patch availableCNA
—org.apache.camel:camel-jms (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-jms (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-jms (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-sjms (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-sjms (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-sjms (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-amqp (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-amqp (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-amqp (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-mina (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-mina (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-mina (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-netty (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-netty (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-netty (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-netty-http (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-netty-http (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-netty-http (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-vertx-http (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-vertx-http (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-vertx-http (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-infinispan (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-infinispan (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-infinispan (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-leveldb (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-leveldb (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-leveldb (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-cassandraql (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-cassandraql (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-cassandraql (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-consul (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-consul (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-consul (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-sql (Maven)4.14.0 to before 4.14.84.14.8Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-sql (Maven)4.18.0 to before 4.18.34.18.3Patch availableGHSA-8h6p-jvhf-9hcr
—org.apache.camel:camel-sql (Maven)4.19.0 to before 4.21.04.21.0Patch availableGHSA-8h6p-jvhf-9hcr
  • Apache Camel VendorApache Affected 4.14.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 Fixed in 4.14.8, 4.18.3, 4.21.0 Patch available CNA
  • org.apache.camel:camel-jms (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-jms (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-jms (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-sjms (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-sjms (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-sjms (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-amqp (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-amqp (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-amqp (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-mina (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-mina (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-mina (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-netty (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-netty (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-netty (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-vertx-http (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-vertx-http (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-vertx-http (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-infinispan (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-infinispan (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-infinispan (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-leveldb (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-leveldb (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-leveldb (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-cassandraql (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-cassandraql (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-cassandraql (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-consul (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-consul (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-consul (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-sql (Maven) Vendor— Affected 4.14.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-sql (Maven) Vendor— Affected 4.18.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-8h6p-jvhf-9hcr
  • org.apache.camel:camel-sql (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-8h6p-jvhf-9hcr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*4.14.0 to before 4.14.8; 4.18.0 to before 4.18.3VulnerableApache
cpe:2.3:a:apache:camel:4.20.0:*:*:*:*:*:*:*4.20.0VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.14.0 to before 4.14.8; 4.18.0 to before 4.18.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:4.20.0:*:*:*:*:*:*:* Versions 4.20.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.14.8, 4.18.3, 4.21.0
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-jms (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-jms (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-jms (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-sjms (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-sjms (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-sjms (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-amqp (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-amqp (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-amqp (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-mina (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-mina (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-mina (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-netty (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-netty (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-netty (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-netty-http (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-netty-http (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-netty-http (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-vertx-http (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-vertx-http (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-vertx-http (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-infinispan (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-infinispan (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-infinispan (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-leveldb (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-leveldb (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-leveldb (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-cassandraql (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-cassandraql (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-cassandraql (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-consul (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-consul (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-consul (Maven) Fixed in 4.21.0 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-sql (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-sql (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-8h6p-jvhf-9hcr org.apache.camel:camel-sql (Maven) Fixed in 4.21.0 Advisory →

Red Hat 1 advisory

  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Camel 4.14.8, 4.18.3, 4.21.0

    14 records Highest priority Priority MEDIUM 7 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2026-35614 Improper input validation in Apache CamelPriority MEDIUM 50
    • TI-2026-34159 Improper input validation in Apache CamelPriority MEDIUM 50
    • TI-2026-34157 Improper input validation in Apache CamelPriority MEDIUM 50
    Show all 14 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Apache Camel 4 for Quarkus 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42527
  2. 2026-10-03 Alias added: GHSA-8h6p-jvhf-9hcr

References

Advisory 3

Other 11

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences