Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101259— Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Quick assessment

Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Camel CoAP 组件存在“生成包含敏感信息的错误消息”漏洞。 受影响版本范围： Apache Camel 4.0.0 至 4.18.5（不含 4.18.5） Apache Camel 4.19.0 至 4.22.2（不含 4.22.2） 漏洞原理： 当 CoAP 消费者在路由执行完成后无法构建响应时，CamelCoapResource 会捕获由此引发的异常，并将异常消息作为 5.00 Internal Server Error 响应的载荷返回给 CoAP 客户端。典型场景为类型转换失败：消费者在

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101259

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
Source: CVE Program / CVE List V5
Vulnerability Description
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Internal Server Error response. The typical case is a type conversion failure: the consumer converts the final message body to the byte[] payload, and the CamelCoapMaxAge and CamelCoapETag headers to their types, after the route has returned, and therefore outside the route's error handler. On the affected releases the message of such a failure names the class of the value being converted, carries the value's string form, and ends with the class name and message of the underlying cause, so a remote CoAP client could read internal detail about the deployment: class and package names, the string form of the value, such as the path of a file body, and whatever the cause carries, which in practice can include paths, host names and connection detail of a backend. The consumer had no option to suppress this, unlike the HTTP consumers, which offer a muteException option for that purpose. The exception raised by a failing route was not sent: the consumer did not check whether the exchange had failed, and answered a route failure with 2.05 Content and whatever body the message held at that point. Reaching the disclosure therefore requires a route whose completed response a remote client can make unconvertible, which depends on how the route is written. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. The upgrade is enough on its own: the new muteException consumer option defaults to true on all three fixed release lines, so the error response carries no payload without any configuration change. For deployments that cannot upgrade immediately, make sure the response can always be built once the route has completed: convert the body to byte[] or String as the last step of each route that consumes from a coap endpoint, for example with convertBodyTo, give the CamelCoapMaxAge and CamelCoapETag headers only values of their own types, and add an onException handler that marks the failure as handled and sets the response body explicitly, so that a conversion failure is raised and replaced inside the route rather than in the consumer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Camel 4.0.0 ~ 4.18.5 -

II. Public POCs for CVE-2026-101259

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101259

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-101259 (4)

Other References for CVE-2026-101259 (5)

Same Patch Batch · Apache Software Foundation · 2026-10-26 · 5 CVEs total

CVE-2026-95628 5.4 MEDIUM Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute P
CVE-2026-95629 5.4 MEDIUM Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Outp
CVE-2026-95664 5.4 MEDIUM Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS
CVE-2026-95663 4.8 MEDIUM Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached

IV. Related Vulnerabilities

Same product: Apache Camel
Same vendor: Apache Software Foundation
Same weakness: CWE-209