{"id":"CVE-2026-101259","kind":"vulnerability","aliases":["CVE-2026-101259"],"related":[],"title":"Apache Camel CoAP: conversion errors leak internal details to remote clients","description":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.\n\n\n\nWhen the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Internal Server Error response. The typical case is a type conversion failure: the consumer converts the final message body to the byte[] payload, and the CamelCoapMaxAge and CamelCoapETag headers to their types, after the route has returned, and therefore outside the route's error handler. On the affected releases the message of such a failure names the class of the value being converted, carries the value's string form, and ends with the class name and message of the underlying cause, so a remote CoAP client could read internal detail about the deployment: class and package names, the string form of the value, such as the path of a file body, and whatever the cause carries, which in practice can include paths, host names and connection detail of a backend. The consumer had no option to suppress this, unlike the HTTP consumers, which offer a muteException option for that purpose. The exception raised by a failing route was not sent: the consumer did not check whether the exchange had failed, and answered a route failure with 2.05 Content and whatever body the message held at that point. Reaching the disclosure therefore requires a route whose completed response a remote client can make unconvertible, which depends on how the route is written.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. The upgrade is enough on its own: the new muteException consumer option defaults to true on all three fixed release lines, so the error response carries no payload without any configuration change. For deployments that cannot upgrade immediately, make sure the response can always be built once the route has completed: convert the body to byte[] or String as the last step of each route that consumes from a coap endpoint, for example with convertBodyTo, give the CamelCoapMaxAge and CamelCoapETag headers only values of their own types, and add an onException handler that marks the failure as handled and sets the response body explicitly, so that a conversion failure is raised and replaced inside the route rather than in the consumer.","summary":"When the Apache Camel CoAP consumer fails to build its response after a route completes, it returns the exception text as the body of a 5.00 Internal Server Error. That text can reveal class names, file paths, host names and backend connection details to any CoAP client that can reach the endpoint.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","coap","java","package","self-hosted"],"not_affected_if":["fixed-version","no-coap-endpoint","non-camel-stack"],"how_to_check":"- Check the Camel version in the project build file (for Maven, `mvn dependency:tree | grep camel-coap`); affected versions are 4.0.0 before 4.18.5 and 4.19.0 before 4.22.2.\n- Look for `coap:` endpoints in routes and confirm whether any route converts the body or the CamelCoapMaxAge and CamelCoapETag headers after the route ends.","fix":"- Upgrade `camel-coap` to `4.23.0`, or to `4.22.2` on the 4.22.x line, or `4.18.5` on the 4.18.x line.\n- End-of-life 4.14.x, 4.15.x to 4.17.x and 4.19.x to 4.21.x releases get no fix and must move to a supported release.\n- Without upgrading, convert the body to `byte[]` or `String` as the last step of each CoAP route (for example with `convertBodyTo`) and add an `onException` handler that sets the response body explicitly.","status":"open","published_at":"2026-10-26T09:16:33+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","triaged_at":"2026-10-26T09:31:02+00:00","updated_at":"2026-10-26T09:31:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T09:31:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `camel-coap` to `4.23.0`, or to `4.22.2` on the 4.22.x line, or `4.18.5` on the 4.18.x line.\n- End-of-life 4.14.x, 4.15.x to 4.17.x and 4.19.x to 4.21.x releases get no fix and must move to a supported release.\n- Without upgrading, convert the body to `byte[]` or `String` as the last step of each CoAP route (for example with `convertBodyTo`) and add an `onException` handler that sets the response body explicitly.","reach":"network","title":"Apache Camel CoAP: conversion errors leak internal details to remote clients","impact":"low","summary":"When the Apache Camel CoAP consumer fails to build its response after a route completes, it returns the exception text as the body of a 5.00 Internal Server Error. That text can reveal class names, file paths, host names and backend connection details to any CoAP client that can reach the endpoint.","category":"package","nicknames":[],"who_cares":["apache-camel","java","coap","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote clients read internal class names, paths and backend connection details","analyst_note":"","how_to_check":"- Check the Camel version in the project build file (for Maven, `mvn dependency:tree | grep camel-coap`); affected versions are 4.0.0 before 4.18.5 and 4.19.0 before 4.22.2.\n- Look for `coap:` endpoints in routes and confirm whether any route converts the body or the CamelCoapMaxAge and CamelCoapETag headers after the route ends.","needs_analyst":false,"not_affected_if":["no-coap-endpoint","fixed-version","non-camel-stack"],"who_is_affected":"Only deployments that run the CoAP consumer on an affected Camel release are exposed. Exposure also depends on the route: the disclosure needs a completed response that a remote client can make unconvertible, which depends on how the route is written. Services that do not expose a CoAP endpoint can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000784,"input_tokens":4105,"output_tokens":746,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101259':14A,17A '-2026':13A,16A '2.05':315C '4.0.0':98C '4.14':397C '4.15':405C '4.17':408C '4.18':384C '4.18.5':100C,395C '4.19':411C '4.19.0':102C '4.21':414C '4.22':367C '4.22.2':104C,378C '4.23.0':357C '5.00':52B,138C 'add':531C 'affect':94C,186C 'alway':486C 'answer':310C 'apach':1A,19B,29B,88C,95C 'apache-camel':18B 'back':128C 'backend':67B,268C 'bodi':49B,157C,249C,319C,496C,545C 'build':35B,111C 'built':488C 'byte':160C,498C 'camel':2A,20B,30B,89C,96C 'camelcoapetag':166C,522C 'camelcoapmaxag':164C,520C 'camelcoapresourc':119C 'cannot':478C 'carri':202C,254C,468C 'case':145C 'caught':120C 'caus':219C,253C 'chang':474C 'check':303C 'class':60B,196C,212C,232C 'client':11A,73B,132C,224C,338C 'coap':3A,21B,31B,72B,90C,107C,131C,223C,512C 'complet':41B,118C,334C,493C 'compon':91C 'configur':473C 'connect':68B,264C 'consum':32B,108C,152C,270C,280C,300C,453C,509C,563C 'contain':83C 'content':316C 'convers':4A,149C,550C 'convert':153C,201C,494C 'convertbodyto':517C 'could':109C,225C 'cve':12A,15A 'default':455C 'depend':343C 'deploy':231C,434C,476C 'detail':8A,69B,228C,265C 'disclosur':328C 'earlier':402C 'end':209C,419C 'endpoint':78B,513C 'enough':446C 'error':5A,55B,81C,141C,182C,466C 'exampl':515C 'except':45B,123C,290C 'exchang':306C 'explicit':546C 'fail':33B,294C,308C 'failur':150C,193C,313C,538C,551C 'file':62B,248C 'final':155C 'fix':359C,432C,461C 'form':207C,238C 'generat':79C 'give':518C 'handl':540C 'handler':183C,534C 'header':167C,523C 'held':322C 'host':26B,64B,261C 'http':279C 'immedi':480C 'includ':259C 'inform':85C 'insid':556C 'intern':7A,53B,139C,227C 'issu':93C,361C,424C 'java':22B 'last':503C 'leak':6A 'life':421C 'line':417C,463C 'make':340C,481C 'mark':536C 'messag':82C,127C,156C,189C,215C,321C 'move':438C 'must':437C 'muteexcept':284C,452C 'name':61B,65B,194C,213C,235C,262C 'new':451C 'offer':282C 'onexcept':533C 'option':273C,285C,454C 'outsid':178C 'packag':23B,234C 'path':63B,245C,260C 'payload':135C,161C,470C 'point':325C 'practic':257C 'purpos':288C 'rais':291C,553C 'rather':559C 'reach':76B,326C,418C 'read':226C 'receiv':430C 'recommend':352C 'releas':187C,369C,386C,399C,416C,442C,462C 'remot':10A,222C,337C 'replac':555C 'requir':330C 'resolv':426C 'respons':37B,113C,142C,335C,467C,484C,544C 'result':122C 'return':43B,175C 'reveal':59B 'rout':40B,116C,173C,180C,295C,312C,332C,347C,491C,507C,558C 'self':25B 'self-host':24B 'sensit':84C 'sent':125C,298C 'server':54B,140C 'set':542C 'step':504C 'stream':370C,387C,400C 'string':206C,237C,500C 'suggest':374C,391C 'support':441C 'suppress':275C 'sure':482C 'text':46B,57B 'therefor':177C,329C 'three':460C 'true':457C 'type':148C,170C,529C 'typic':144C 'unconvert':341C 'under':218C 'unlik':277C 'upgrad':354C,376C,393C,444C,479C 'user':350C,363C,380C 'valu':199C,204C,241C,525C 'version':356C 'vulner':86C 'whatev':251C,318C 'whether':304C 'whose':333C 'without':471C 'written':349C 'x':368C,385C,398C,406C,409C,412C,415C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run the CoAP consumer on an affected Camel release are exposed. Exposure also depends on the route: the disclosure needs a completed response that a remote client can make unconvertible, which depends on how the route is written. Services that do not expose a CoAP endpoint can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101259","severity":null,"published_at":"2026-10-26T09:16:33+00:00","modified_at":"2026-10-26T09:16:33+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","fetched_at":"2026-10-26T09:29:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}