# org.apache.camel:camel-core (Maven) vulnerabilities 12 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.23.0 (Oct 11, 2026): no advisory affects it - Newest unaffected release: 4.23.0 (Oct 11, 2026), the latest release - Dependents: 198 - Releases: 298 since 1.0.0 (Jul 2, 2007) - Registry: https://central.sonatype.com/artifact/org.apache.camel/camel-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-85312: 4.0.0 to 4.18.4 (4.18.5 is outside it); 4.19.0 to 4.22.0 (4.22.1 is outside it) - CVE-2024-22371: 3.0.0 to 3.21.3 (3.21.4 is outside it); 3.22.0 (3.22.1 is outside it); 4.0.0 to 4.0.3 (4.0.4 is outside it); 4.1.0 to 4.3.0 (4.4.0 is outside it) - CVE-2020-11971: 1.0.0 to 3.1.0 (3.2.0 is outside it) - CVE-2019-0188: 1.0.0 to 2.23.4 (2.24.0 is outside it) - CVE-2019-0194: 2.21.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it); 2.23.0 (2.23.1 is outside it) - CVE-2018-8027: 2.20.0 to 2.20.3 (2.20.4 is outside it); 2.21.0 (2.21.1 is outside it) - CVE-2017-5643: 1.0.0 to 2.17.5 (2.17.6 is outside it); 2.18.0 to 2.18.1 (2.18.2 is outside it) - CVE-2015-0264: 1.0.0 to 2.13.3 (2.13.4 is outside it); 2.14.0 to 2.14.1 (2.14.2 is outside it) - CVE-2015-0263: 1.0.0 to 2.13.3 (2.13.4 is outside it); 2.14.0 to 2.14.1 (2.14.2 is outside it) - CVE-2014-0003: 2.11.0 to 2.11.3 (2.11.4 is outside it); 2.12.0 to 2.12.2 (2.12.3 is outside it) - CVE-2014-0002: 1.0.0 to 2.11.3 (2.11.4 is outside it); 2.12.0 to 2.12.2 (2.12.3 is outside it) - CVE-2013-4330: 1.0.0 to 2.9.6 (2.9.7 is outside it); 2.10.0 to 2.10.6 (2.10.7 is outside it); 2.11.0 to 2.11.1 (2.11.2 is outside it); 2.12.0 (2.12.1 is outside it) ## Advisories (12) ### [CVE-2026-85312](https://cve.now/CVE-2026-85312): Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header - Severity: Medium 4.8 - Published: Oct 19, 2026 - Affected: from 4.0.0, fixed in 4.18.5; from 4.19.0, fixed in 4.22.1. - Fixed in 4.18.5 (released Oct 6, 2026, 13 days before disclosure) and 4.22.1 (released Sep 13, 2026, 36 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2024-22371](https://cve.now/CVE-2024-22371): Apache Camel issue on ExchangeCreatedEvent - Severity: Low 2.9 - Published: Feb 26, 2024 - Affected: from 3.0.0, fixed in 3.21.4; from 3.22.0, fixed in 3.22.1; from 4.0.0, fixed in 4.0.4; from 4.1.0, fixed in 4.4.0. - Fixed in 3.21.4 (released Jan 24, 2024, 33 days before disclosure), 3.22.1 (released Jan 25, 2024, 32 days before disclosure), 4.0.4 (released Jan 27, 2024, 30 days before disclosure) and 1 other version. - The latest release, 4.23.0, is not affected. ### [CVE-2020-11971](https://cve.now/CVE-2020-11971): Apache Camel's JMX is vulnerable to Rebind Flaw. - Severity: Unrated - Published: May 14, 2020 - Affected: fixed in 3.2.0. - Fixed in 3.2.0 (released Apr 1, 2020, 43 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2019-0188](https://cve.now/CVE-2019-0188): Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable… - Severity: Unrated - Published: May 28, 2019 - Affected: fixed in 2.24.0. - Fixed in 2.24.0 (released May 6, 2019, 22 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2019-0194](https://cve.now/CVE-2019-0194): Apache Camel's File is vulnerable to directory traversal. - Severity: Unrated - Published: Apr 30, 2019 - Affected: from 2.21.0, fixed in 2.21.5; from 2.22.0, fixed in 2.22.3; from 2.23.0, fixed in 2.23.1. - Fixed in 2.21.5 (released Feb 2, 2019, 87 days before disclosure), 2.22.3 (released Jan 19, 2019, 101 days before disclosure) and 2.23.1 (released Jan 12, 2019, 108 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2018-8027](https://cve.now/CVE-2018-8027): Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor. - Severity: Unrated - Published: Jul 31, 2018 - Affected: from 2.20.0, fixed in 2.20.4; from 2.21.0, fixed in 2.21.1. - Fixed in 2.20.4 (released Jul 21, 2018, 10 days before disclosure) and 2.21.1 (released Apr 29, 2018, 93 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2017-5643](https://cve.now/CVE-2017-5643): Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. - Severity: Unrated - Published: Mar 16, 2017 - Affected: fixed in 2.17.6; from 2.18.0, fixed in 2.18.2. - Fixed in 2.17.6 (released Mar 5, 2017, 11 days before disclosure) and 2.18.2 (released Jan 22, 2017, 53 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2015-0264](https://cve.now/CVE-2015-0264): Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2… - Severity: Unrated - Published: Jun 3, 2015 - Affected: fixed in 2.13.4; from 2.14.0, fixed in 2.14.2. - Fixed in 2.13.4 (released Mar 5, 2015, 90 days before disclosure) and 2.14.2 (released Mar 3, 2015, 92 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2015-0263](https://cve.now/CVE-2015-0263): XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and… - Severity: Unrated - Published: Jun 3, 2015 - Affected: fixed in 2.13.4; from 2.14.0, fixed in 2.14.2. - Fixed in 2.13.4 (released Mar 5, 2015, 90 days before disclosure) and 2.14.2 (released Mar 3, 2015, 92 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2014-0003](https://cve.now/CVE-2014-0003): The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to… - Severity: Unrated - Published: Mar 20, 2014 - Affected: from 2.11.0, fixed in 2.11.4; from 2.12.0, fixed in 2.12.3. - Fixed in 2.11.4 (released Feb 15, 2014, 33 days before disclosure) and 2.12.3 (released Feb 21, 2014, 27 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2014-0002](https://cve.now/CVE-2014-0002): The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly… - Severity: Unrated - Published: Mar 20, 2014 - Affected: fixed in 2.11.4; from 2.12.0, fixed in 2.12.3. - Fixed in 2.11.4 (released Feb 15, 2014, 33 days before disclosure) and 2.12.3 (released Feb 21, 2014, 27 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2013-4330](https://cve.now/CVE-2013-4330): Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple… - Severity: Unrated - Published: Oct 4, 2013 - Affected: fixed in 2.9.7; from 2.10.0, fixed in 2.10.7; from 2.11.0, fixed in 2.11.2; from 2.12.0, fixed in 2.12.1. - Fixed in 2.9.7 (released Apr 24, 2013, 163 days before disclosure), 2.10.7 (released Sep 15, 2013, 19 days before disclosure), 2.11.2 (released Sep 19, 2013, 15 days before disclosure) and 1 other version. - The latest release, 4.23.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.camel:camel-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.