{"schemaVersion":3,"id":"CVE-2026-42527","aliases":["CGA-5m47-3x85-52gv","GHSA-8h6p-jvhf-9hcr","CGA-xf96-c9fq-pfvm"],"status":"published","duplicateOf":null,"title":null,"description":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\nThe default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. The class-level filter check passes because the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository).\nThis issue affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not include javax.**).","dates":{"published":"2026-07-06T07:55:06.159Z","modified":"2026-07-06T18:47:30.650Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":5.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":5.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00668,"percentile":0.50991,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00668},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00668,"percentile":0.50991}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00668,"percentile":0.50991}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/502.html"}],"affected":[{"vendor":"apache software foundation","product":"apache camel","name":"Apache Camel","label":"apache camel","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.15.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.15.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_camel"},{"vendor":"apache","product":"camel","name":"camel","label":"camel","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"4.20.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | 4.20.0","eol":{"isEol":true,"eolDate":"2026-06-26T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4.20","label":"4.20","eolFrom":"2026-06-26T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"4.20.0"},"product":{"name":"apache-camel","label":"Apache Camel","category":"framework"}},"hubHref":"/vendor/apache/camel"},{"vendor":"chainguard","product":"apache-camel-karavan-devmode","name":"apache-camel-karavan-devmode","label":"apache-camel-karavan-devmode","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-camel-karavan-devmode","purlType":"apk","versions":[{"text":"< 4.18.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.18.1-r10","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-amqp","name":"org.apache.camel:camel-amqp","label":"camel-amqp","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-amqp","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-cassandraql","name":"org.apache.camel:camel-cassandraql","label":"camel-cassandraql","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-cassandraql","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-consul","name":"org.apache.camel:camel-consul","label":"camel-consul","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-consul","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-infinispan","name":"org.apache.camel:camel-infinispan","label":"camel-infinispan","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-infinispan","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-jms","name":"org.apache.camel:camel-jms","label":"camel-jms","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-jms","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-leveldb","name":"org.apache.camel:camel-leveldb","label":"camel-leveldb","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-leveldb","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-mina","name":"org.apache.camel:camel-mina","label":"camel-mina","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-mina","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-netty","name":"org.apache.camel:camel-netty","label":"camel-netty","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-netty","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-netty-http","name":"org.apache.camel:camel-netty-http","label":"camel-netty-http","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-netty-http","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-sjms","name":"org.apache.camel:camel-sjms","label":"camel-sjms","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-sjms","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-sql","name":"org.apache.camel:camel-sql","label":"camel-sql","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-sql","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null},{"vendor":"org.apache.camel","product":"camel-vertx-http","name":"org.apache.camel:camel-vertx-http","label":"camel-vertx-http","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.camel/camel-vertx-http","purlType":"maven","versions":[{"text":"≥ 4.14.0, < 4.14.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.18.0, < 4.18.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.19.0, < 4.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.14.8 | ≥ 4.18.0, < 4.18.3 | ≥ 4.19.0, < 4.21.0","eol":null,"hubHref":null}],"affectedCount":15,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://camel.apache.org/security/CVE-2026-42527.html","label":"camel.apache.org/security/CVE-2026-42527.html","hostname":"camel.apache.org","tags":["Vendor Advisory","Advisory","WEB","Mitigation"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/05/4","label":"www.openwall.com/lists/oss-security/2026/07/05/4","hostname":"www.openwall.com","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://repo.maven.apache.org/maven2","label":"repo.maven.apache.org/maven2","hostname":"repo.maven.apache.org","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42527.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42527.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42527","label":"nvd.nist.gov/vuln/detail/CVE-2026-42527","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/camel/pull/22801","label":"github.com/apache/camel/pull/22801","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/pull/22813","label":"github.com/apache/camel/pull/22813","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/pull/22815","label":"github.com/apache/camel/pull/22815","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/commit/1b60801edf9864465db7abf391539ee425a53e2c","label":"github.com/apache/camel/commit/1b60801edf9864465db7abf391539ee425a53e2c","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/commit/1ea8bf4b20898a570f0ac366c9be07ec300cce8d","label":"github.com/apache/camel/commit/1ea8bf4b20898a570f0ac366c9be07ec300cce8d","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/commit/bc7f8cafd1d4752bf6b5a77c19fe9878258faffb","label":"github.com/apache/camel/commit/bc7f8cafd1d4752bf6b5a77c19fe9878258faffb","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel","label":"github.com/apache/camel","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/apache/camel/releases/tag/camel-4.14.7","label":"github.com/apache/camel/releases/tag/camel-4.14.7","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/releases/tag/camel-4.18.2","label":"github.com/apache/camel/releases/tag/camel-4.18.2","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/camel/releases/tag/camel-4.21.0","label":"github.com/apache/camel/releases/tag/camel-4.21.0","hostname":"github.com","tags":["WEB"]},{"url":"https://issues.apache.org/jira/browse/CAMEL-23372","label":"issues.apache.org/jira/browse/CAMEL-23372","hostname":"issues.apache.org","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-CVC7-M2MX-4X3X"]},"timeline":[{"kind":"published","date":"2026-07-06T07:55:06.159Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-06T18:47:30.650Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:09:13.343Z","stale":false,"partial":false}}