CVE-2026-85246
Received Received - Intake

Information Exposure in Apache Camel Mina Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote exchange.getException() straight back over the socket to the remote peer. Over a textline codec that hands the peer the exception's class name and message; over the object codec it hands over the serialised exception, cause chain included. A remote peer able to provoke a failure could therefore read internal detail about the deployment - class and package names, and whatever a message or nested cause happens to carry, which in practice can include paths, host names and connection detail. The consumer had no option to suppress this, unlike the HTTP-family consumers aligned by CAMEL-23651. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. A muteException consumer option, defaulting to true, replaces the route exception with a generic one carrying no class name, message or stack trace, while still writing a reply so that a synchronous peer is not left to time out. Set muteException=false to restore the previous behaviour. For deployments that cannot upgrade immediately, add an onException handler that sets the reply body explicitly, so the framework never writes the exception back to the peer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85246
EUVD
EUVD-2026-104187

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in Apache Camel's Mina component. When processing fails, the system sends exception details back to the remote peer over the socket. This exposes sensitive information like class names, package names, exception messages, paths, host names, and connection details. The vulnerability affects Apache Camel versions from 4.0.0 before 4.18.5, 4.19.0 before 4.22.1, and 4.23.0.

Detection Guidance

To detect this vulnerability, check the Apache Camel version in use with commands like 'camel --version' or inspect the application's dependency files (e.g., pom.xml for Maven). If the version is between 4.0.0 and 4.18.4, 4.19.0 and 4.22.0, or exactly 4.23.0, the system is vulnerable. Additionally, monitor network traffic for unhandled exceptions being sent over sockets in the Mina component.

Impact Analysis

An attacker could exploit this to gain internal system details, including deployment paths, host names, and connection information. This could aid further attacks or expose sensitive data. The impact is limited to information disclosure; no direct code execution or data modification is possible.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized disclosure of sensitive information. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exposed internal details may violate these regulations.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0, 4.18.5, or 4.22.1 immediately. If upgrading is not possible, set the muteException consumer option to true in the Mina configuration to suppress sensitive exception details. Alternatively, add an onException handler to explicitly set the reply body and prevent the framework from writing exceptions back to peers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart