CVE-2017-5643: Apache Camel using an outdated vulnerable JSON-lib library
Summary
CVE-2017-5643: Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. Affects org.apache.camel:camel-core across 2 version ranges.
< 2.17.6
>= 2.18.0, < 2.18.2
Fixed in 2.17.6 or 2.18.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies. The Camel Core package is a fundamental component of Apache Camel, providing essential functionality for message routing and transformation. Unfortunately, this package is vulnerable to a specific issue related to the usage of an outdated and vulnerable JSON-lib library.
Vulnerability Detail
The vulnerability in Apache Camel's Validation Component allows for Server-Side Request Forgery (SSRF) attacks via remote Document Type Definitions (DTDs) and XML External Entity (XXE) attacks. An attacker can exploit this vulnerability to make arbitrary requests to internal resources or retrieve sensitive information from the server. This can lead to unauthorized access, data leakage, and potential compromise of the entire system.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.17.62.17.6 -
>= 2.18.0, < 2.18.22.18.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Apache Camel Core package to the fixed version as soon as possible.
Conclusion
Apache Camel's Validation Component in the Camel Core package is vulnerable to SSRF and XXE attacks. To mitigate this vulnerability, it is crucial to update the package to version 2.17.6 or higher. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-core →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies.
The Camel Core package is a fundamental component of Apache Camel, providing essential functionality for message routing and transformation.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make arbitrary requests from the vulnerable server to internal resources or external systems.
XML External Entity (XXE) is a vulnerability that allows an attacker to include external entities in an XML document, leading to potential information disclosure or denial of service.
This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-core.
