CVE-2014-0003: Apache Camel's XSLT component allows remote code execution
Summary
CVE-2014-0003: Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods. Affects org.apache.camel:camel-core across 2 version ranges.
>= 2.11.0, < 2.11.4
>= 2.12.0, < 2.12.3
Fixed in 2.11.4 or 2.12.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies. The XSLT component in Apache Camel is responsible for transforming XML messages using XSLT stylesheets. This component is vulnerable to a remote code execution vulnerability.
Vulnerability Detail
The XSLT component in Apache Camel versions 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods by sending a crafted message. This vulnerability can be exploited by an attacker to execute arbitrary code on the target system, potentially leading to a complete compromise of the system. The vulnerability arises due to insufficient input validation and sanitization of the XSLT stylesheets.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.11.0, < 2.11.42.11.4 -
>= 2.12.0, < 2.12.32.12.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a possible workaround is to disable or restrict the usage of the XSLT component in Apache Camel. This can be achieved by removing or disabling the XSLT component from the Camel routes. However, this workaround may impact the functionality of the affected system, and it is strongly recommended to upgrade to a fixed version as soon as possible.
Conclusion
The XSLT component in Apache Camel is vulnerable to remote code execution, allowing attackers to execute arbitrary Java methods. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of Apache Camel and implement input validation and sanitization mechanisms. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-core →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies.
The XSLT component in Apache Camel is responsible for transforming XML messages using XSLT stylesheets. It allows developers to apply XSLT transformations to XML data within the Camel routes.
This vulnerability allows remote attackers to execute arbitrary Java methods on the target system. This can lead to a complete compromise of the system and unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade Apache Camel to version 2.11.4 or later if using version 2.11.x, or version 2.12.3 or later if using version 2.12.x. Additionally, input validation and sanitization mechanisms should be implemented to prevent the execution of arbitrary Java methods.
A possible workaround is to disable or restrict the usage of the XSLT component in Apache Camel by removing or disabling it from the Camel routes. However, this may impact the functionality of the affected system, and upgrading to a fixed version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-core.
