CVE-2026-85246

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description The Mina component fails to suppress sensitive information when an exchange processing failure occurs. The Mina consumer sends the result of exchange.getException() directly to the remote peer via the socket. Depending on the codec used, this may expose the exception class name, message, or the entire serialized exception and cause chain. An attacker capable of triggering a failure can obtain internal deployment details, including package names, file paths, host names, and connection details.

Recommendations Upgrade to version 4.18.5 for users on the 4.18.x LTS stream. Upgrade to version 4.22.1 for users on the 4.22.x LTS stream. Upgrade to version 4.23.0. As a temporary workaround, add an onException handler that explicitly sets the reply body to prevent the framework from sending the exception to the peer.