CVE-2026-84180

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description The Knative HTTP consumer in the Apache Camel Knative component fails to properly handle exchange processing failures on the consumer side. In such cases, the consumer writes the resulting exception—including the class name, message, and stack trace—directly back to the remote caller as the response body. This allows an external sender to trigger failures and obtain internal deployment details, such as class and package names, file system or host names, and the route structure. Additionally, if exception messages contain configuration or connection strings, this information is disclosed.

Recommendations Upgrade to version 4.18.5 for users on the 4.18.x LTS release stream. Upgrade to version 4.22.1 for users on the 4.22.x LTS release stream. Upgrade to version 4.23.0. As a temporary workaround, add an onException handler that explicitly sets the response body to prevent the framework from writing the exception back to the caller.