2.9
Low
CVE-2024-22371 Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that…
Description
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Camel 4.0 | 4.0.x → 4.0.3 | No fix stated |
| Apache Camel 4 | 4.x → 4.3.0 | No fix stated |
| Apache Camel 3.22 | 3.22.x → 3.22.0 | No fix stated |
| Apache Camel 3.21 | 3.21.x → 3.21.3 | No fix stated |
| Apache Camel 1 | earliest → < 1.x | 1.x |
Other CVEs of Apache Camel
The 97 CVEs of Apache Camel →
CVE-2026-71569
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component
4.8
Medium
CVE-2026-90885
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component
7.5
High
CVE-2026-94386
Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component
4.8
Medium
CVE-2026-95628
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling…
5.4
Medium