CVE-2013-4330: Improper Control of Generation of Code in Apache Camel
Summary
CVE-2013-4330: Improper Control of Generation of Code in Apache Camel. Affects org.apache.camel:camel-core across 4 version ranges.
< 2.9.7
>= 2.10.0, < 2.10.7
>= 2.11.0, < 2.11.2
>= 2.12.0, < 2.12.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to easily connect different systems and applications using various protocols and technologies. Camel Core is the main module of Apache Camel, providing the core functionality and components for message routing and transformation. This vulnerability affects versions before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0.
Vulnerability Detail
The vulnerability in Apache Camel allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a FILE or FTP producer. This can lead to unauthorized code execution and potential compromise of the affected system. The vulnerability is rated as MODERATE severity and has been assigned the Common Weakness Enumeration (CWE) ID CWE-94.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.9.72.9.7 -
>= 2.10.0, < 2.10.72.10.7 -
>= 2.11.0, < 2.11.22.11.2 -
>= 2.12.0, < 2.12.12.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache Camel.
Conclusion
The vulnerability in Apache Camel allows remote code execution by exploiting a flaw in the handling of message headers. It is important to upgrade to the fixed versions of Apache Camel to mitigate the risk of unauthorized code execution and potential compromise of the affected system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-core →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to easily connect different systems and applications using various protocols and technologies.
This vulnerability allows remote attackers to execute arbitrary code by including malicious expressions in a message header. This can lead to unauthorized code execution and potential compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Camel. Upgrade to version 2.9.7 if using versions before 2.9.7, upgrade to version 2.10.7 if using versions between 2.10.0 and 2.10.7, upgrade to version 2.11.2 if using versions between 2.11.0 and 2.11.2, and upgrade to version 2.12.1 if using version 2.12.0.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache Camel.
You can find more information about this vulnerability in the GitHub Advisory Database. Please refer to the provided source link for detailed information.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-core.
