Apache Camel fixes 38 flaws; 4.14 users get no patch

Apache Camel fixes 38 flaws; 4.14 users get no patch

16 October 2026: The Apache Camel project has published 38 security advisories for its Java integration framework, 13 rated High and 25 Medium, all fixed in Camel 4.23.0 and the long-term-support releases 4.22.1 and 4.18.5. The 4.14 LTS line reached end of life after 4.14.9 and gets none of the fixes, although 35 of the 38 flaws affect it.

Not yet independently verified. Apache rates each advisory only High or Medium, without CVSS scores, and the advisory pages carry no publication date; the 15 October date comes from the project blog. No exploitation has been reported. We will update this when it can be confirmed, and remove this note.

Which release to move to

The project's upgrade table is short:

You run	Upgrade to
4.22.x (LTS)	4.22.1
4.18.x (LTS)	4.18.5
any other release	4.23.0, or 4.22.1 or 4.18.5 to stay on an LTS line

The advisory index gives most affected ranges as everything from 4.0.0 before 4.18.5, and from 4.19.0 before 4.22.1; a few components start later, such as camel-smooks from 4.7.0 and camel-keycloak from 4.15.0. The project warns that "some of the fixes change default behaviour", and lists each change in the 4.23 upgrade guide, so a minor-version jump needs a test pass rather than a straight dependency bump. The project says 28 of the findings came from an AI-assisted security scan run under an Apache Software Foundation initiative, and 10 from outside researchers.

The jgroups and Redis deserialization flaws

The most serious item for most deployments is CVE-2026-88900 in camel-jgroups. The consumer reads each message body through JGroups' Message.getObject(), which runs Java deserialization with no filter unless the JVM has one set globally. By default the endpoint creates a stock JGroups channel that multicasts over UDP with no authentication or encryption, so any host that can reach the multicast group or port can join and send a crafted object. With a usable gadget chain on the classpath that becomes remote code execution, and no unusual option is needed on the consumer. Apache rates it High rather than Critical because the attacker needs adjacent network access.

CVE-2026-78165 is the same class of bug in camel-spring-redis, which deserialized Redis payloads unfiltered.

The other High-rated issues

• Header-driven requests: CVE-2026-78164 lets the message-supplied CamelHttpUri and CamelRestHttpUri headers trigger property placeholder resolution in camel-http, camel-netty-http, camel-undertow and camel-vertx-http.
• File transfer: CVE-2026-79983 to 79986 are path traversal through file names in remote listings, in camel-ftp, camel-mina-sftp, camel-smb and camel-azure-files.
• Authentication: CVE-2026-80312 in camel-oauth let a route continue after failed authentication; CVE-2026-80343 bypasses camel-netty-http security constraints by changing the case of the path.
• Other: CVE-2026-80344 (camel-as2 SSRF and credential disclosure through the MDN address), CVE-2026-83531 (camel-dynamic-router code execution through a control-message predicate), CVE-2026-85250 and CVE-2026-88901 (XXE in camel-xpath and camel-smooks), and CVE-2026-85251 (camel-http re-sends the Authorization header to whatever host a redirect names).

Among the Medium items, CVE-2026-85260 matters for healthcare integrations: camel-mllp logged protected health information by default.

Where Camel hides in a stack

Camel is rarely bought on its own. It sits inside integration platforms, ESB distributions and Spring Boot or Quarkus services, so the version that matters is the one bundled in each application, not the one a team last chose. A dependency report across services is the quickest way to find 4.14 or older builds before an auditor does. Our integration software category lists 18 products.

Sources

• Apache Camel blog: security advisories, 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0, 16 October 2026
• Apache Camel: security advisories index (read 2026-10-19), 19 October 2026
• Apache Camel: CVE-2026-88900, camel-jgroups deserialization (read 2026-10-19), 19 October 2026