Apache Camel Mina CVE-2026-85246

Exploitation requires the target to deploy the Apache Camel camel-mina component as a consumer (socket server) operating in sync mode on an affected version (4.0.0 before 4.18.5, or 4.19.0 before 4.22.1), so that a reply is written back to the peer. The attacker must be able to reach that socket and provoke a failure during exchange processing; the information exposed depends on the codec in use - the textline codec leaks only the exception class name and message, while the object codec serialises the entire exception and cause chain. Before the fix there was no option to suppress this, so default configurations are affected. Limiting factors: the leak only occurs on the Mina consumer path (not the more common HTTP consumers), the severity of leaked data varies by what exceptions carry, and impact is confined to information disclosure with no code execution or data modification.

This is a moderate-severity information-disclosure issue (CWE-209) best treated as low-priority hardening rather than an urgent threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) is internally consistent with the description: a remote, unauthenticated peer can trigger the leak with low complexity, but impact is limited to low confidentiality with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no conflict among the available signals; they uniformly point to a real but low-consequence flaw. The practical risk is proportional to what the leaked exception messages actually contain (class/package names, and potentially paths, hostnames, or connection detail), which varies by deployment. Exploitation is further gated by the deployment actually using the camel-mina component as a sync consumer, which is a niche transport. Net: genuine data-leak worth patching, but not a high-real-risk emergency.

An attacker who can reach a service built on Apache Camel's Mina consumer sends crafted input that causes the exchange to fail during processing. The framework writes exchange.getException() back over the socket - the exception class name and message over the textline codec, or the full serialised exception and cause chain over the object codec - handing the attacker internal deployment detail such as package names, file paths, hostnames, or connection strings. No public exploit code is identified, but triggering a processing failure is straightforward against a reachable endpoint.