CVE-2020-11971 in the critical feed json
Improper Input Validation in Apache Camel
published 2020-05-14 6 y ago modified 2026-09-10 1 mo ago also GHSA-hfg5-xpvw-c9x4 , EUVD-2021-1101
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.0%
- EPSS 14.0% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Patch / fix
- maven org.apache.camel:camel 3.2.0
- maven org.apache.camel:camel-core 3.2.0
- maven org.apache.camel:camel-management 3.2.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-11971 updated cvss 7.5
camel: DNS Rebinding in JMX Connector could result in remote command execution
-
Red Hat JBoss Data Grid 7 camel-coreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Fuse 7.8.0fixed: vendor fix RHSA-2020:5568
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
13.96% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.camel:camel | <3.2.0 |
3.2.0 |
| maven | org.apache.camel:camel-core | <3.2.0 |
3.2.0 |
| maven | org.apache.camel:camel-management | <3.2.0 |
3.2.0 |
Affected products
- n/a Apache Camel
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
openwall.com
/lists/oss-security/2020/05/14/7
mailing-list, web, patch, third-party-advisory
-
camel.apache.org
/security/CVE-2020-11971.html
web, patch, vendor-advisory
-
oracle.com
/security-alerts/cpuapr2022.html
web, patch, third-party-advisory
-
github.com
/apache/camel/commit/b954402272ddcfbb45dc1495520f920e70cc041c
web
-
lists.apache.org
/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4%40%3Ccommits.camel.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9%40%3Ccommits.camel.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a%40%3Ccommits.camel.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79%40%3Cissues.activemq.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468%40%3Cissues.activemq.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a%40%3Cissues.activemq.apache.org%3E
mailing-list
-
oracle.com
/security-alerts/cpuoct2020.html
web, third-party-advisory
-
lists.apache.org
/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386%40%3Cissues.activemq.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649%40%3Cissues.activemq.apache.org%3E
mailing-list
-
oracle.com
/security-alerts/cpujan2021.html
web, third-party-advisory
-
lists.apache.org
/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2020-11971
advisory
-
lists.apache.org
/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649@%3Cissues.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468@%3Cissues.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386@%3Cissues.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a@%3Cissues.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79@%3Cissues.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9@%3Ccommits.camel.apache.org%3E
web
-
issues.apache.org
/jira/browse/CAMEL-14811
web
-
github.com
/apache/camel
package
Sources
- CVE List CVE-2020-11971
- GitHub Advisory GHSA-hfg5-xpvw-c9x4
- NVD CVE-2020-11971
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.