What is the CVSS score of CVE-2026-48205?

CVE-2026-48205 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-48205?

Apache Camel DNS component (versions 4.0.0-4.20.x) contains a critical server-side request forgery vulnerability that allows unauthenticated attackers to enumerate internal network hostnames through…. A patch is available.

How to fix or mitigate CVE-2026-48205?

Within 24 hours: Conduct inventory scan to identify all systems running Apache Camel 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x. Within 7 days: Apply vendor-released patch per Apache Camel security advisory. Within 30 days: Implement network segmentation restricting outbound DNS resolution to authorized resolvers only; audit and disable dns: component producers on any routes exposed to HTTP clients.

Apache Camel CVE-2026-48205

EUVD-2026-41840 CRITICAL

Improper Input Validation (CWE-20)

2026-07-05

GHSA-hcm8-x79p-wx2w

Apache SSRF Microsoft Camel

9.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 CRITICAL

Remote unauthenticated when the vulnerable HTTP-to-DNS route is present, but impact is limited to internal-hostname existence disclosure (C:L) and DNS-answer tampering (I:L), with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:17 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:17 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

9.1 (CRITICAL)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:43 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 maven packages depend on org.apache.camel:camel-dns (3 direct, 6 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Server-side request forgery in the Apache Camel camel-dns component lets any HTTP client control DNS lookups when a route bridges an HTTP consumer (e.g. platform-http) into a dns: producer. Because the dns.server, dns.name, dns.domain, dns.type, dns.class and term headers lack the Camel/camel prefix, HttpHeaderFilterStrategy does not strip them at the HTTP boundary, so an attacker can point the resolver at an attacker-controlled DNS server and enumerate internal hostnames. It affects Camel 4.0.0-4.14.7, 4.15.0-4.18.2 and 4.19.0-4.20.x; no public exploit identified at time of analysis, and EPSS is low (0.15%), but SSVC rates the flaw automatable with total technical impact.

Technical ContextAI

Apache Camel is a Java enterprise integration framework built around routes that move messages (Exchanges) between components. The camel-dns component wraps the dnsjava library to perform DNS lookups (dig, ip, lookup, wikipedia operations), reading its parameters from Exchange message headers. The root cause is CWE-20 Improper Input Validation manifesting as SSRF: the header constants DnsConstants.DNS_SERVER/DNS_NAME/DNS_DOMAIN/DNS_TYPE/DNS_CLASS/TERM were defined as the bare strings dns.server, dns.name, dns.domain, dns.type, dns.class and term. Camel's HttpHeaderFilterStrategy only filters the reserved Camel/camel-prefixed header namespace when crossing the HTTP boundary, so these unprefixed headers survive from an inbound HTTP request into the Exchange and drive the dnsjava SimpleResolver, letting an external client dictate which resolver is queried and for what name/record type.

RemediationAI

Vendor-released patch: 4.21.0 is the primary fix; users on the 4.14.x LTS stream should upgrade to 4.14.8 and users on the 4.18.x stream to 4.18.3. After upgrading, routes that drive DNS operations must switch from the raw header names to the newly-prefixed constants CamelDnsServer, CamelDnsName, CamelDnsDomain, CamelDnsType, CamelDnsClass and CamelDnsTerm, since these are now filtered at the HTTP boundary. For deployments that cannot upgrade immediately, strip the dns.server, dns.name, dns.domain, dns.type, dns.class and term headers from all untrusted ingress before the dns: producer and set the DNS server and lookup parameters from a trusted source inside the route; the trade-off is that any legitimate flow relying on those raw headers will break and must be re-plumbed to the trusted values. Guidance is at https://camel.apache.org/security/CVE-2026-48205.html.