Severity:
CVSS 3.1: 5.3 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-grpc) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-grpc) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-grpc) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-grpc) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-grpc) 4.23.0 unaffected
Description:
Generation of Error Message Containing Sensitive Information vulnerability in
Apache Camel gRPC component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
When a route behind a gRPC consumer failed, the exception's message was placed
into the gRPC status description. Unlike the status cause, which stays local to
the server, the description is transmitted to the calling client, so an
external caller able to provoke a failure could read the internal error
message. What that discloses depends on the exception, and in practice includes
class and package names, paths, host names and connection detail carried in
messages. This is the gRPC member of the same unmuted-consumer-exception family
as the knative, mina and CXF advisories published alongside it.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. A muteException consumer option, defaulting to
true, puts a generic description in the status instead of the route exception's
message. Set muteException=false to restore the previous output. For
deployments that cannot upgrade immediately, map failures onto an explicit
status in an onException handler so the framework never copies the exception
message into the description.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. A muteException consumer option, defaulting to
true, puts a generic description in the status instead of the route exception's
message. Set muteException=false to restore the previous output.
Work Arounds:
For deployments that cannot upgrade immediately, map failures onto an explicit
status in an onException handler so the framework never copies the exception
message into the description.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-85315.html
https://issues.apache.org/jira/browse/CAMEL-24478
https://github.com/apache/camel/pull/25839
https://github.com/apache/camel/pull/25934
https://github.com/apache/camel/pull/25935
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-85315
