CVE-2026-101259

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.1

Description The CoAP component in Apache Camel contains an issue where the CamelCoapResource catches exceptions occurring after a route completes and sends the exception message back to the CoAP client as a 5.00 Internal Server Error response. This typically happens during type conversion failures when the consumer converts the final message body to a byte[] payload or processes CamelCoapMaxAge and CamelCoapETag headers. Consequently, a remote client may obtain sensitive internal deployment details, including class and package names, file body paths, host names, and backend connection details. This occurs because the consumer lacks a mechanism to suppress these exceptions, unlike HTTP consumers.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.2 for those on the 4.22.x release stream. Upgrade to version 4.18.5 for those on the 4.18.x release stream. As a temporary mitigation, ensure the response can always be built by converting the body to byte[] or String as the final step of each route consuming from a CoAP endpoint using convertBodyTo, providing only correct types for CamelCoapMaxAge and CamelCoapETag headers, and implementing an onException handler to mark failures as handled and explicitly set the response body.