What is the CVSS score of CVE-2026-49042?

CVE-2026-49042 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-49042?

A flaw in Apache Camel versions 4.8.0-4.20.0 permits unauthenticated remote attackers to extract sensitive information and degrade system integrity and availability through improper input validation.. A patch is available.

How to fix or mitigate CVE-2026-49042?

24 hours: Inventory all systems running Apache Camel versions 4.8.0-4.18.2 or 4.19.0-4.20.0. 7 days: Upgrade affected instances to version 4.18.3 (for 4.8.0-4.18.2 line) or 4.21.0 (for 4.19.0-4.20.0 line) and coordinate with integration stakeholders to validate functionality. 30 days: Conduct post-patch security testing and review logs for exploitation attempts.

Apache Camel CVE-2026-49042

EUVD-2026-41864 HIGH

Improper Input Validation (CWE-20)

2026-07-06 apache

GHSA-hh8r-75r6-qrg9

Apache Information Disclosure Apache Camel Apache Software Foundation

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable and unauthenticated with low complexity (AV:N/AC:L/PR:N/UI:N), but only partial impact given an information-disclosure-oriented input-validation flaw, so C/I/A each Low.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 19:40 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 19:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 19:22 NVD

7.3 (HIGH)

Analysis Generated

Jul 06, 2026 - 11:03 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.apache.camel:camel-langchain4j-tools (3 direct, 3 indirect)

Ecosystem-wide dependent count for version 4.8.0.

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Camel.

This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0.

Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

AnalysisAI

Improper input validation in Apache Camel versions 4.8.0 through 4.18.2 and 4.19.0 through 4.20.0 allows remote unauthenticated attackers to send crafted input that the framework fails to validate, yielding limited information disclosure and partial integrity/availability impact per the CVSS vector. The flaw is reported directly by the Apache Software Foundation and is fixed in 4.18.3 and 4.21.0; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. The moderate 7.3 (High) score reflects easy network reachability but limited per-impact severity (C:L/I:L/A:L).

Technical ContextAI

Apache Camel is a widely deployed open-source Java integration framework implementing Enterprise Integration Patterns, used to route and mediate messages between systems via hundreds of components and endpoints. The root cause is classified as CWE-20 (Improper Input Validation), meaning the framework accepts externally supplied input without adequately verifying that it conforms to expected structure, type, or constraints before processing it. The affected artifact is identified by CPE cpe:2.3:a:apache_software_foundation:apache_camel and, per the vendor tag, the practical consequence is Information Disclosure. Because Camel typically sits at trust boundaries between services, an input-validation gap in a component or header/parameter handling path can expose or alter data flowing through a route, though the exact vulnerable component is not detailed in the available advisory summary.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.18.3 (for the 4.8.0-4.18.2 branch) or 4.21.0 (for the 4.19.0-4.20.0 branch), as recommended by the Apache advisory at https://camel.apache.org/security/CVE-2026-49042.html. Because the specific vulnerable component is not disclosed in the available summary, review that advisory to identify whether a particular Camel component, endpoint, or route is implicated and, if immediate patching is not possible, restrict or disable exposure of that route and place untrusted-facing Camel endpoints behind an authenticating gateway or input-filtering proxy that enforces strict schema/type validation on incoming messages - noting this may reject some legitimately malformed-but-tolerated traffic and requires knowledge of the exact affected input path. Given only Low impact metrics, upgrading during the normal maintenance window is a reasonable priority absent evidence of exploitation, but should be expedited for internet-exposed integrations.