CVE-2026-85246: Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
When processing of an exchange failed, the Mina consumer wrote exchange.getException() straight back over the socket to the remote peer. Over a textline codec that hands the peer the exception's class name and message; over the object codec it hands over the serialised exception, cause chain included. A remote peer able to provoke a failure could therefore read internal detail about the deployment - class and package names, and whatever a message or nested cause happens to carry, which in practice can include paths, host names and connection detail. The consumer had no option to suppress this, unlike the HTTP-family consumers aligned by CAMEL-23651.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. A muteException consumer option, defaulting to true, replaces the route exception with a generic one carrying no class name, message or stack trace, while still writing a reply so that a synchronous peer is not left to time out. Set muteException=false to restore the previous behaviour. For deployments that cannot upgrade immediately, add an onException handler that sets the reply body explicitly, so the framework never writes the exception back to the peer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camel Mina componentto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camel Mina componentto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camel Mina componentto a version that resolves this vulnerability.Fixed in 4.22.1 - Configuration
For deployments that cannot upgrade immediately, add an onException handler that sets the reply body explicitly so the exception is not written back to the peer.
Apache Camel Mina consumer onException reply body = explicit reply body
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache Camel applications using the Mina component are affected in versions 4.0.0 through before 4.18.5, and 4.19.0 through before 4.22.1. The exposure occurs when a Mina consumer processes an exchange that fails and returns the exception to the remote peer.
What must an attacker be able to do?
An attacker needs network access to a vulnerable Mina consumer and must be able to provoke exchange processing failure. No authentication or user interaction is required according to the supplied vector.
What information can be disclosed?
With a textline codec, the remote peer can receive the exception class name and message. With the object codec, it can receive the serialized exception and its cause chain, potentially disclosing paths, host names, connection details, class names, package names, and other data carried in exception messages or nested causes.
Is the fixed behavior enabled by default?
Yes. The fix introduces the Mina consumer muteException option, which defaults to true and replaces the route exception returned to the peer with a generic exception that contains no class name, message, or stack trace.
Which versions remediate the issue?
Upgrade to Apache Camel 4.23.0. For the LTS release streams identified in the advisory, upgrade 4.18.x deployments to 4.18.5 and 4.22.x deployments to 4.22.1.