CVE-2024-22369highCWE-502

CVE-2024-22369: high-severity vulnerability in Apache Camel

Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository

Published · Updated

Follow this CVE+ Monitor Apache Camel+ Monitor org.apache.camel:camel-sql

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.7%
Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Camel
Related CVEs — Apache Camel

In the same product, most dangerous first.

CVE-2025-27636MEDIUMApache Camel: Camel Message Header Injection via Improper FilteringEPSS 97.1%CVE-2025-29891MEDIUMApache Camel: Camel Message Header Injection through request parametersEPSS 76.1%CVE-2026-47323CRITICALApache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringEPSS 19.6%CVE-2016-8749—CVE-2016-8749EPSS 10.6%CVE-2018-8041—CVE-2018-8041EPSS 9.6%CVE-2026-33453CRITICALApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionEPSS 9.2%