CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-30177 – Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering
https://notcve.org/view.php?id=CVE-2025-30177
01 Apr 2025 — Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction. This allows... • https://camel.apache.org/security/CVE-2025-27636.html • CWE-164: Improper Neutralization of Internal Special Elements •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-29891 – Apache Camel: Camel Message Header Injection through request parameters
https://notcve.org/view.php?id=CVE-2025-29891
12 Mar 2025 — Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-ex... • https://camel.apache.org/security/CVE-2025-27636.html • CWE-164: Improper Neutralization of Internal Special Elements •
CVSS: 7.5EPSS: 42%CPEs: 3EXPL: 3CVE-2025-27636 – Apache Camel: Camel Message Header Injection via Improper Filtering
https://notcve.org/view.php?id=CVE-2025-27636
09 Mar 2025 — Bypass/Injection vulnerability in Apache Camel-Bean component under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is only present in the following situation. The user is using one of the following HTTP Servers via one the of the following Camel components * camel-servlet * ca... • https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC • CWE-178: Improper Handling of Case Sensitivity CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax •
CVSS: 2.9EPSS: 0%CPEs: 4EXPL: 1CVE-2024-22371 – Apache Camel issue on ExchangeCreatedEvent
https://notcve.org/view.php?id=CVE-2024-22371
26 Feb 2024 — Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue. Exposición de datos confidenciales mediante la creación de un EventFactory malicioso y proporcionando un... • https://github.com/vishalborkar7/POC_for_-CVE-2024-22371 • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-922: Insecure Storage of Sensitive Information •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-23114 – Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository
https://notcve.org/view.php?id=CVE-2024-23114
20 Feb 2024 — Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to... • https://camel.apache.org/security/CVE-2024-23114.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 1CVE-2024-22369 – Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
https://notcve.org/view.php?id=CVE-2024-22369
20 Feb 2024 — Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1 Vulnerabilidad de deserialización de datos no confiables en el co... • https://github.com/oscerd/CVE-2024-22369 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 94%CPEs: 444EXPL: 19CVE-2023-44487 – HTTP/2 Rapid Reset Attack Vulnerability
https://notcve.org/view.php?id=CVE-2023-44487
10 Oct 2023 — The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. El protocolo HTTP/2 permite una denegación de servicio (consumo de recursos del servidor) porque la cancelación de solicitudes puede restablecer muchas transmisiones rápidamente, como se explotó en la naturaleza entre agosto y octubre de 2023. A flaw was found in handling multiplexed streams in the HTTP/2 protocol. ... • https://github.com/imabee101/CVE-2023-44487 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 3.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-34442 – Apache Camel JIRA: Temporary file information disclosure in Camel-Jira
https://notcve.org/view.php?id=CVE-2023-34442
10 Jul 2023 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3. Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1 • https://lists.apache.org/thread/x4vy2hhbltb1xrvy1g6m8hpjgj2k7wgh • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 72%CPEs: 72EXPL: 2CVE-2021-4104 – Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
https://notcve.org/view.php?id=CVE-2021-4104
14 Dec 2021 — JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in Au... • https://github.com/cckuailong/log4shell_1.x • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-11994 – camel: server-side template injection and arbitrary file disclosure on templating components
https://notcve.org/view.php?id=CVE-2020-11994
08 Jul 2020 — Server-Side Template Injection and arbitrary file disclosure on Camel templating components Una Inyección de Plantilla del Lado de Servidor y divulgación de archivos arbitrarios en componentes de plantillas Camel A flaw was found in camel. Camel's templating components are suseptable to Server-Side Template Injection and arbitrary file disclosure. The highest threat from this vulnerability is to data confidentiality. Red Hat Fuse provides a small-footprint, flexible, open source enterprise service bus and i... • https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •