Apache Camel 2026 security fixes

{
  "id": "fcb2b5ba8094515d881cb104d25643741fb9910c6df34f83bb3b5c32a5294b56",
  "url": "https://camel.apache.org/blog/2026/07/camel-security-advisories-4.21.0/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Apache Camel 2026 security fixes",
    "summary": "Apache Camel released security fixes across its supported lines: 4.21.0, 4.18.3, and 4.14.8. Upgrade to the version for your release line to receive the fixes; the article also notes an exception for CVE-2026-49042 on 4.14.x.",
    "evidence": "Camel 4.21.0 shipped on 1 July with 32 security fixes. 4.18.3 followed on 3 July with 34, and 4.14.8 on 4 July with 27.",
    "products": [
      {
        "name": {
          "value": "Apache Camel",
          "evidence": "Apache Camel release announcements"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.21.0",
            "evidence": "4.19.x or 4.20.x 4.21.0 all 32"
          },
          {
            "value": "4.18.3",
            "evidence": "4.18.x (LTS) 4.18.3 all 32, plus 2 earlier findings"
          },
          {
            "value": "4.14.8",
            "evidence": "4.14.x (LTS) 4.14.8 26 of the 32, plus 1 earlier finding"
          }
        ],
        "affected_versions": [
          {
            "value": "4.19.x or 4.20.x",
            "evidence": "4.19.x or 4.20.x 4.21.0 all 32"
          },
          {
            "value": "4.18.x (LTS)",
            "evidence": "4.18.x (LTS) 4.18.3 all 32, plus 2 earlier findings"
          },
          {
            "value": "4.14.x (LTS)",
            "evidence": "4.14.x (LTS) 4.14.8 26 of the 32, plus 1 earlier finding"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-42527",
        "evidence": "That is CVE-2026-42527, a vulnerability we introduced ourselves"
      },
      {
        "value": "CVE-2026-43866",
        "evidence": "CVE-2026-43866 4.14.8, 4.18.3, 4.21.0 (1 to 4 Jul)"
      },
      {
        "value": "CVE-2026-49042",
        "evidence": "The real exception is CVE-2026-49042 in camel-langchain4j-tools, which does affect 4.14.x going back to 4.8.0."
      },
      {
        "value": "CVE-2026-46726",
        "evidence": "CVE-2026-46726, HIGH"
      },
      {
        "value": "CVE-2026-53913",
        "evidence": "CVE-2026-53913 (HIGH)"
      },
      {
        "value": "CVE-2026-56140",
        "evidence": "CVE-2026-56140 is rated LOW and has no exploit path at all."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-apache-camel-blog",
  "document_id": 23043,
  "published_at": "2026-07-29T00:00:00+00:00"
}