CVE-2026-101259: Information Disclosure in Apache Camel CoAP

CVE-2026-101259 affects the CoAP component in Apache Camel in a concrete scenario: when a consumer's response cannot be converted (for example, type conversion failure), the component sends the full error message to the CoAP client as the payload of a 5.00 response. This message contains class names, file paths, hostnames and backend connection details, exposing directly to any remote client capable of triggering a conversion failure the internal architecture of the deployment.

The CVSS is 5.3 (medium severity), but the risk is real for deployments with public CoAP endpoints. Information disclosure about internal structure is a starting point for network reconnaissance. Published on 2026-10-26, by 2026-10-29 a public reproducer exists on GitHub. Affected: 4.0.0 before 4.18.5, 4.19.0 before 4.22.2; earlier and intermediate streams receive no patches due to end of life.

The immediate mitigation is to upgrade to 4.18.5, 4.22.2 or 4.23.0+: in these releases the muteException option is active by default and suppresses error payloads.

If upgrade is impossible immediately, defenders must ensure every route consuming from CoAP converts the body to byte[] or String as the final step, uses only typed CamelCoapMaxAge and CamelCoapETag headers, and adds an onException handler that explicitly sets the response body.