{"id":"CVE-2020-11971","aliases":["EUVD-2021-1101","GHSA-hfg5-xpvw-c9x4"],"status":"published","title":"Improper Input Validation in Apache Camel","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.13959,"percentile":0.96571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-05-14T16:18:41Z","modified":"2026-10-24T10:30:59Z","fixes":[{"ecosystem":"Maven","package":"org.apache.camel:camel","fixed_in":["3.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.camel:camel-core","fixed_in":["3.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.camel:camel-management","fixed_in":["3.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["1.6.2","1.6.3","1.6.4","2.0-M3","2.0.0","2.1.0","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.11.0","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.14.0","2.14.1","2.14.2","2.14.3","2.14.4","2.15.0","2.15.1","2.15.2","2.15.3","2.15.4","2.15.5","2.15.6","2.16.0","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.17.0","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.17.6","2.17.7","2.18.0","2.18.1","2.18.2","2.18.3","2.18.4","2.18.5","2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.19.5","2.2.0","2.20.0","2.20.1","2.20.2","2.20.3","2.20.4","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.22.0","2.22.1","2.22.2","2.22.3","2.22.4","2.22.5","2.23.0","2.23.1","2.23.2","2.23.3","2.23.4","2.24.0","2.24.1","2.24.2","2.24.3","2.25.0","2.25.1","2.25.2","2.25.3","2.25.4","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.9.0","2.9.0-RC1","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","3.0.0","3.0.0-M1","3.0.0-M2","3.0.0-M3","3.0.0-M4","3.0.0-RC1","3.0.0-RC2","3.0.0-RC3","3.0.1","3.1.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","2.0-M1","2.0-M2","2.0-M3","2.0.0","2.1.0","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.11.0","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.14.0","2.14.1","2.14.2","2.14.3","2.14.4","2.15.0","2.15.1","2.15.2","2.15.3","2.15.4","2.15.5","2.15.6","2.16.0","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.17.0","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.17.6","2.17.7","2.18.0","2.18.1","2.18.2","2.18.3","2.18.4","2.18.5","2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.19.5","2.2.0","2.20.0","2.20.1","2.20.2","2.20.3","2.20.4","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.22.0","2.22.1","2.22.2","2.22.3","2.22.4","2.22.5","2.23.0","2.23.1","2.23.2","2.23.3","2.23.4","2.24.0","2.24.1","2.24.2","2.24.3","2.25.0","2.25.1","2.25.2","2.25.3","2.25.4","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.9.0","2.9.0-RC1","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","3.0.0","3.0.0-M1","3.0.0-M2","3.0.0-M3","3.0.0-M4","3.0.0-RC1","3.0.0-RC2","3.0.0-RC3","3.0.1","3.1.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["3.0.0","3.0.0-RC2","3.0.0-RC3","3.0.1","3.1.0"]}],"products":[{"vendor":"apache","product":"camel"},{"vendor":"apache software foundation","product":"apache camel"},{"vendor":"oracle","product":"communications_diameter_intelligence_hub"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"enterprise_manager_base_platform"},{"vendor":"oracle","product":"flexcube_private_banking"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2020/05/14/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://camel.apache.org/security/CVE-2020-11971.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11971","tags":["advisory"]},{"url":"https://github.com/apache/camel/commit/b954402272ddcfbb45dc1495520f920e70cc041c","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/CAMEL-14811","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hfg5-xpvw-c9x4"},{"url":"https://github.com/apache/camel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-11971","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.","status":"published","published":"2020-05-14T16:18:41Z","modified":"2024-08-04T11:48:56.399Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2021-1101","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.","status":"published","published":"2020-05-14T16:18:41Z","modified":"2024-08-04T11:48:56Z","updated_at":"2026-11-03T03:07:41.399649Z"}],"ghsa":[{"id":"GHSA-hfg5-xpvw-c9x4","title":"Improper Input Validation in Apache Camel","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel users should upgrade to 3.2.0.","status":"published","published":"2021-05-21T19:20:30Z","modified":"2023-04-14T19:27:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:50.476488Z"}],"nvd":[{"id":"CVE-2020-11971","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.","status":"published","published":"2020-05-14T17:15:12.053Z","modified":"2026-06-17T02:51:09.497Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-11971","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.","status":"published","published":"2020-05-14T17:15:12.053Z","modified":"2026-10-24T10:30:59.253506418Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"GHSA-hfg5-xpvw-c9x4","title":"Improper Input Validation in Apache Camel","description":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel users should upgrade to 3.2.0.","status":"published","published":"2021-05-21T19:20:30Z","modified":"2026-09-10T03:49:14.897028482Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}