Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.

Severity: All Critical High

Library: apache_camel

CVE-2026-40860 CRITICAL CVSS 9.8 Verified Advisory Jul 24, 2026

Deserialization fix bypass via DefaultExchangeHolder in Apache Camel JMS (CVE-2026-40860)

The post-deserialization class allowlist introduced to fix CVE-2026-40860 in Apache Camel's JMS components can be bypassed by wrapping a crafted payload inside a `DefaultExchangeHolder` object, which resides in the al...

Fixed in 4.21.0

RCE Apache Deserialization Camel

CVE-2026-33454 CRITICAL CVSS 9.4 Verified Advisory Jul 24, 2026

Message header injection in Apache Camel camel-mail component (CVE-2026-33454)

The Camel-Mail component's custom header filter strategy (MailHeaderFilterStrategy) filters only the outbound direction and leaves the inbound direction unconfigured, allowing Camel-prefixed MIME headers from incoming...

Fixed in 4.14.6; 4.18.1; 4.19.0

Apache Deserialization Microsoft Apache Software Foundation

CVE-2026-33453 CRITICAL CVSS 10.0 Verified Advisory Jul 24, 2026

Header injection leading to remote code execution in Apache Camel camel-coap (CVE-2026-33453)

The camel-coap component in Apache Camel maps incoming CoAP request URI query parameters directly into Camel Exchange message headers without applying any HeaderFilterStrategy, allowing injection of arbitrary Camel in...

Fixed in 4.14.6; 4.18.1; 4.19.0

RCE Apache Command Injection Microsoft