High [CVE-2026-83531] Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel
This high-severity Apache Software Foundation advisory covers CVE-2026-83531 affecting Apache Camel.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.
The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages.
When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers.
DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed.
- 4.4.0 before 4.18.5
- 4.19.0 before 4.22.1
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 4.18.5
- 4.22.1
- 4.23.0
- 4.4.0
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers.
- Users are recommended to upgrade to version 4.23.0, which fixes the issue.
- If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
- After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted.
- For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint.
- As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-91858Oct 19, 2026FopProducer transforms the incoming XSL-FO message body by creating
- CVE-2026-88901Oct 19, 2026Apache Camel XXE
- CVE-2026-85315Oct 19, 2026Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel
- CVE-2026-78162Oct 19, 2026Deserialization of Untrusted Data vulnerability in Apache Camel
- CVE-2026-80354Sep 10, 2026Authorization bypass through User-Controlled key vulnerability in Apache Camel K
- CVE-2026-80351Sep 10, 2026Improper neutralization of directives in dynamically evaluated code ('eval injection')
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.