MavenPackage

org.apache.camel:camel-mina

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-85246
Affects 4.0.0 to 4.18.4 (4.18.5 is outside it); 4.19.0 to 4.22.0 (4.22.1 is outside it)
CVE-2026-42527
Affects 4.14.0 to 4.14.7 (4.14.8 is outside it); 4.18.0 to 4.18.2 (4.18.3 is outside it); 4.19.0 to 4.20.0 (4.21.0 is outside it)
CVE-2026-40473
Affects 3.0.0 to 4.14.5 (4.14.6 is outside it); 4.15.0 to 4.18.1 (4.18.2 is outside it); 4.19.0 (4.20.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-85246Medium 5.3
Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
Affected: from 4.0.0, fixed in 4.18.5; from 4.19.0, fixed in 4.22.1.
Fixed in 4.18.5 (released Oct 6, 2026, 13 days before disclosure) and 4.22.1 (released Sep 13, 2026, 36 days before disclosure).
The latest release, 4.23.0, is not affected.
CVE-2026-42527High 8.1
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net. and enables DNS-based information disclosure
Affected: from 4.14.0, fixed in 4.14.8; from 4.18.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0.
Fixed in 4.14.8 (released Jun 28, 2026, 8 days before disclosure), 4.18.3 (released Jun 28, 2026, 8 days before disclosure) and 4.21.0 (released Jun 27, 2026, 9 days before disclosure).
The latest release, 4.23.0, is not affected.
CVE-2026-40473High 8.8
Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP
Affected: from 3.0.0, fixed in 4.14.6; from 4.15.0, fixed in 4.18.2; from 4.19.0, fixed in 4.20.0; from 3.0.0, fixed in 4.14.6; from 4.15.0, fixed in 4.18.2; from 4.19.0, fixed in 4.20.0.
Fixed in 4.14.6 (released Apr 14, 2026, 13 days before disclosure), 4.18.2 (released Apr 15, 2026, 12 days before disclosure) and 4.20.0 (released Apr 23, 2026, 4 days before disclosure).
The latest release, 4.23.0, is not affected.