CVE Tools
Track your stack

Apache Camel

99 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Apache Camel, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Camel CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Camel CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-032
2025-041
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-045
2026-051
2026-060
2026-0722
2026-088
2026-090
2026-1047
2026-110

Severity

How the 99 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2222%
  • High3434%
  • Medium4242%
  • Low11%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Camel.

  1. CVE-2026-71569Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name4.8
  2. CVE-2026-90885Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved7.5
  3. CVE-2026-94386Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache4.8
  4. CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)5.4
  5. CVE-2026-95629Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory5.4
  6. CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry4.8
  7. CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions5.4
  8. CVE-2026-101259Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions5.3
  9. CVE-2026-88900Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution8.8
  10. CVE-2026-91858Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present6.5
  11. CVE-2026-88901Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default8.2
  12. CVE-2026-85317Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache4.8
  13. CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching4.8
  14. CVE-2026-85315Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions5.3
  15. CVE-2026-85314Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)6.5

Product grouping is registry-driven, with AI assist and human review. How it works