Improper Integrity Check Validation in Apache Camel Crypto PGP Component
CVE-2026-85243

5.9MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
19 October 2026

What is CVE-2026-85243?

An integrity check validation issue in Apache Camel's Crypto PGP component allows an attacker to bypass integrity checks for certain encrypted messages. This vulnerability is present in versions prior to 4.18.5 and 4.22.1, where specific messages can evade necessary integrity checks during decryption. As a result, messages lacking integrity protection can be accepted, compromising data authenticity and security. Upgrading to Apache Camel version 4.23.0 or later is recommended to ensure all messages are thoroughly validated for integrity. Users on legacy streams should also upgrade to the respective recommended versions to mitigate potential risks associated with unverified data.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

References

https://camel.apache.org/security/CVE-2026-85243.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24441
issue-tracking
https://github.com/apache/camel/pull/25848
patch

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Andrea Cosentino
.