Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component.
CVE-2026-101259
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Internal Server Error response. The typical case is a type conversion failure: the consumer converts the final message body to the byte[] payload, and the CamelCoapMaxAge and CamelCoapETag headers to their types, after the route has returned, and therefore outside the route's error handler. On the affected releases the message of such a failure names the class of the value being converted, carries the value's string form, and ends with the class name and message of the underlying cause, so a remote CoAP client could read internal detail about the deployment: class and package names, the string form of the value, such as the path of a file body, and whatever the cause carries, which in practice can include paths, host names and connection detail of a backend. The consumer had no option to…
Proof-of-concept code is published
Public PoC
- Public PoCoscerd/CVE-2026-101259
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 5.3 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 26 October 2026
- Last updated
- 26 October 2026
- Weakness
- CWE-209
- Assigner
- security@apache.org
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
At the source
References
- https://camel.apache.org/security/CVE-2026-101259.html
- https://camel.apache.org/security/CVE-2026-84180.html
- https://camel.apache.org/security/CVE-2026-85246.html
- https://camel.apache.org/security/CVE-2026-85257.html
- https://camel.apache.org/security/CVE-2026-85315.html
- https://github.com/apache/camel/pull/26994
- https://github.com/apache/camel/pull/27046
- https://github.com/apache/camel/pull/27048
- https://issues.apache.org/jira/browse/CAMEL-25087
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-101259