org.apache.camel/camel-http-common vulnerabilities

Latest org.apache.camel/camel-http-common CVEs

Newest publication first

1. CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

   Published 2026-10-19

   High·CVSS 8.2 EPSS 0.34%

   Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, fro...

2. CVE-2015-5348 Apache Camel can allow remote attackers to execute arbitrary commands

   Published 2016-04-15

   High·CVSS 8.1 EPSS 6.4%

   Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.