Apache Camel CoAP CVE-2026-101259

Exploitation requires a Camel route that consumes from a coap, coaps, coap+tcp, or coaps+tcp endpoint and whose completed response a remote client can make unconvertible - specifically, the final message body cannot be converted to byte[], or the CamelCoapMaxAge/CamelCoapETag headers cannot be converted to their expected types, with the failure occurring after the route returns and outside the route's error handler. On affected versions there is no muteException option to suppress the leaked message. Whether a remote client can actually trigger an unconvertible response depends entirely on how the route is written, which is the primary limiting factor; related route-failure disclosure (a failing route previously answered with 2.05 Content) similarly depends on route design. Only confidentiality of internal deployment detail is at stake - no code execution, data modification, or denial of service.

This is a medium-severity information-disclosure flaw whose real-world priority is modest and heavily deployment-dependent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) indicates remote, unauthenticated, low-complexity access with only low confidentiality impact and no integrity or availability impact, which matches a flaw that leaks internal error text rather than granting code execution or data manipulation. No EPSS score, KEV listing, or SSVC exploitation/automatable/technical-impact values were supplied, and the vuln.today decision label is 'awaiting_data', so none of the exploitation-probability signals are available to confirm or contradict the CVSS reading - there is no public exploit identified at time of analysis. The AC:L metric is in tension with the description, which states that reaching the disclosure requires a route whose completed response a remote client can make unconvertible and that this 'depends on how the route is written'; this is a real environmental precondition that narrows exploitability well below what AC:L alone implies, so the effective risk is lower than the base score suggests. Net: a genuine-but-limited issue worth patching in the normal cycle rather than an emergency, with the main consequence being leakage of class/package names, file paths, host names, and backend connection detail that could aid reconnaissance.

A remote CoAP client repeatedly sends requests to a vulnerable Camel coap consumer whose route produces a final body or CamelCoapMaxAge/CamelCoapETag header value that cannot be converted to the required type after the route completes. The consumer catches the conversion failure outside the route's error handler and returns its message as the payload of a 5.00 Internal Server Error, exposing the value's class, its string form (for example a file path), and the underlying cause's class and message (which may include paths, host names, and backend connection detail). No public exploit is identified at time of analysis, and success depends on how the specific route is written.