Error Message Exposure in Apache Camel Mina Component

CVE-2026-85246

What is CVE-2026-85246?

A vulnerability exists in the Apache Camel Mina component that allows for the generation of error messages containing sensitive information. When an exchange fails, the Mina consumer inadvertently sends the contents of exchange.getException() back to the remote peer through the socket. This can reveal sensitive internal deployment details such as class names, package names, and potentially private data included in exception messages. Attackers able to trigger a failure in this context could exploit this to gain insights into the application's architecture, potentially leading to further security risks. To mitigate this issue, upgrading to Apache Camel 4.23.0 or later is recommended. For users on the 4.18.x and 4.22.x LTS releases, upgrading to versions 4.18.5 and 4.22.1 respectively will resolve this issue. Additionally, implementing an onException handler to explicitly manage the response can provide further protection.

References