Apache Camel 4.22 LTS includes fixes for security gaps identified during AI-assisted review

{
  "id": "e8172b9b48525b9c7ed03f24a35f4d1dddca9c4bde5b5b0ab9b0c77f36469c52",
  "url": "https://camel.apache.org/blog/2026/07/camel-not-afraid-of-ai/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Apache Camel 4.22 LTS includes fixes for security gaps identified during AI-assisted review",
    "summary": "The Apache Camel project says the upcoming 4.22 LTS release includes fixes for issues found in an AI-assisted code review, including bypassed decompression-bomb protection and XSLT secure processing that was not applied as documented.",
    "evidence": "The Camel 4.22 LTS release — planned for August 2026 — will ship with every one of these fixes.",
    "products": [
      {
        "name": {
          "value": "Apache Camel",
          "evidence": "The Apache Camel project pointed a frontier AI model at 19 years of code"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.22.0",
            "evidence": "Every bug mentioned in this post is tracked in Apache Camel JIRA under fix version 4.22.0."
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-apache-camel-blog",
  "document_id": 23047,
  "published_at": "2026-07-20T00:00:00+00:00"
}