Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.camel:camel-core

12 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
4.23.0 (Oct 11, 2026): no advisory affects it
Newest unaffected release
4.23.0 (Oct 11, 2026), the latest release
Advisories
12 · 1 medium, 1 low
Dependents
198
Releases
298 since 1.0.0 (Jul 2, 2007)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-85312
    Affects 4.0.0 to 4.18.4 (4.18.5 is outside it); 4.19.0 to 4.22.0 (4.22.1 is outside it)
  • CVE-2024-22371
    Affects 3.0.0 to 3.21.3 (3.21.4 is outside it); 3.22.0 (3.22.1 is outside it); 4.0.0 to 4.0.3 (4.0.4 is outside it); 4.1.0 to 4.3.0 (4.4.0 is outside it)
  • CVE-2020-11971
    Affects 1.0.0 to 3.1.0 (3.2.0 is outside it)
  • CVE-2019-0188
    Affects 1.0.0 to 2.23.4 (2.24.0 is outside it)
  • CVE-2019-0194
    Affects 2.21.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it); 2.23.0 (2.23.1 is outside it)
  • CVE-2018-8027
    Affects 2.20.0 to 2.20.3 (2.20.4 is outside it); 2.21.0 (2.21.1 is outside it)
  • CVE-2017-5643
    Affects 1.0.0 to 2.17.5 (2.17.6 is outside it); 2.18.0 to 2.18.1 (2.18.2 is outside it)
  • CVE-2015-0264
    Affects 1.0.0 to 2.13.3 (2.13.4 is outside it); 2.14.0 to 2.14.1 (2.14.2 is outside it)
  • CVE-2015-0263
    Affects 1.0.0 to 2.13.3 (2.13.4 is outside it); 2.14.0 to 2.14.1 (2.14.2 is outside it)
  • CVE-2014-0003
    Affects 2.11.0 to 2.11.3 (2.11.4 is outside it); 2.12.0 to 2.12.2 (2.12.3 is outside it)
  • CVE-2014-0002
    Affects 1.0.0 to 2.11.3 (2.11.4 is outside it); 2.12.0 to 2.12.2 (2.12.3 is outside it)
  • CVE-2013-4330
    Affects 1.0.0 to 2.9.6 (2.9.7 is outside it); 2.10.0 to 2.10.6 (2.10.7 is outside it); 2.11.0 to 2.11.1 (2.11.2 is outside it); 2.12.0 (2.12.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • CVE-2026-85312Medium 4.8

    Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

    Affected: from 4.0.0, fixed in 4.18.5; from 4.19.0, fixed in 4.22.1.

    Fixed in 4.18.5 (released Oct 6, 2026, 13 days before disclosure) and 4.22.1 (released Sep 13, 2026, 36 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel issue on ExchangeCreatedEvent

    Affected: from 3.0.0, fixed in 3.21.4; from 3.22.0, fixed in 3.22.1; from 4.0.0, fixed in 4.0.4; from 4.1.0, fixed in 4.4.0.

    Fixed in 3.21.4 (released Jan 24, 2024, 33 days before disclosure), 3.22.1 (released Jan 25, 2024, 32 days before disclosure), 4.0.4 (released Jan 27, 2024, 30 days before disclosure) and 1 other version.

    The latest release, 4.23.0, is not affected.

  • Apache Camel's JMX is vulnerable to Rebind Flaw.

    Affected: fixed in 3.2.0.

    Fixed in 3.2.0 (released Apr 1, 2020, 43 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable…

    Affected: fixed in 2.24.0.

    Fixed in 2.24.0 (released May 6, 2019, 22 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel's File is vulnerable to directory traversal.

    Affected: from 2.21.0, fixed in 2.21.5; from 2.22.0, fixed in 2.22.3; from 2.23.0, fixed in 2.23.1.

    Fixed in 2.21.5 (released Feb 2, 2019, 87 days before disclosure), 2.22.3 (released Jan 19, 2019, 101 days before disclosure) and 2.23.1 (released Jan 12, 2019, 108 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.

    Affected: from 2.20.0, fixed in 2.20.4; from 2.21.0, fixed in 2.21.1.

    Fixed in 2.20.4 (released Jul 21, 2018, 10 days before disclosure) and 2.21.1 (released Apr 29, 2018, 93 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

    Affected: fixed in 2.17.6; from 2.18.0, fixed in 2.18.2.

    Fixed in 2.17.6 (released Mar 5, 2017, 11 days before disclosure) and 2.18.2 (released Jan 22, 2017, 53 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2…

    Affected: fixed in 2.13.4; from 2.14.0, fixed in 2.14.2.

    Fixed in 2.13.4 (released Mar 5, 2015, 90 days before disclosure) and 2.14.2 (released Mar 3, 2015, 92 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and…

    Affected: fixed in 2.13.4; from 2.14.0, fixed in 2.14.2.

    Fixed in 2.13.4 (released Mar 5, 2015, 90 days before disclosure) and 2.14.2 (released Mar 3, 2015, 92 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to…

    Affected: from 2.11.0, fixed in 2.11.4; from 2.12.0, fixed in 2.12.3.

    Fixed in 2.11.4 (released Feb 15, 2014, 33 days before disclosure) and 2.12.3 (released Feb 21, 2014, 27 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly…

    Affected: fixed in 2.11.4; from 2.12.0, fixed in 2.12.3.

    Fixed in 2.11.4 (released Feb 15, 2014, 33 days before disclosure) and 2.12.3 (released Feb 21, 2014, 27 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple…

    Affected: fixed in 2.9.7; from 2.10.0, fixed in 2.10.7; from 2.11.0, fixed in 2.11.2; from 2.12.0, fixed in 2.12.1.

    Fixed in 2.9.7 (released Apr 24, 2013, 163 days before disclosure), 2.10.7 (released Sep 15, 2013, 19 days before disclosure), 2.11.2 (released Sep 19, 2013, 15 days before disclosure) and 1 other version.

    The latest release, 4.23.0, is not affected.