NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Apache Camel
view advisory published 2026-04-29
Apache Software Foundation heeft kwetsbaarheden verholpen in Apache Camel.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27172US | — | Exploit | ||
The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized… | ||||
| CVE-2026-40858US | — | Exploit | ||
The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without apply… | ||||
| CVE-2026-40022US | —OT elevated | Exploit | ||
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin… | ||||
| CVE-2026-33454US | — | Exploit | ||
The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out'… | ||||
| CVE-2026-40860US | — | Exploit | ||
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectM… | ||||
| CVE-2026-40473US | — | Exploit | ||
The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loa… | ||||
| CVE-2026-40453US | — | Exploit | ||
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'C… | ||||
| CVE-2026-40048US | — | Exploit | ||
The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying a… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan