org.apache.camel/camel-vertx-http vulnerabilities

Latest org.apache.camel/camel-vertx-http CVEs

Newest publication first

1. CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

   Published 2026-10-19

   High·CVSS 8.2 EPSS 0.34%

   Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, fro...

2. CVE-2026-42527 Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

   Published 2026-07-06

   High·CVSS 8.1 EPSS 0.67%

   Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.;javax.;org.apache.camel.;!*', or the no-'javax.' variant in the aggregation-r...

3. CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

   Published 2026-07-06

   High·CVSS 8.1 EPSS 0.89%

   Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHtt...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.