Apache Camel Under Fire: Multiple RCE Flaws Expose Critical Integration Infrastructure

Researchers disclosed multiple critical vulnerabilities in the Apache Camel integration framework that allow unauthenticated or remotely triggered Remote Code Execution through unsafe Java deserialization and header/query-parameter injection across components (Consul, Infinispan, camel-coap, camel-mail, and key lifecycle handling). Several CVEs are noted, including cases where attackers who can write to backing stores or send a single CoAP packet can trigger gadget chains or inject Camel-prefixed headers to execute OS commands; fixes and recommended upgrade versions are provided.