GHSA-4jrw-64vr-7g8m
Apache Camel camel-neo4j component is vulnerable to cypher injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.camel:camel-neo4j | >= 4.10.0, < 4.10.8 | 4.10.8 |
| Maven | org.apache.camel:camel-neo4j | >= 4.14.0, < 4.14.3 | 4.14.3 |
| Maven | org.apache.camel:camel-neo4j | >= 4.15.0, < 4.17.0 | 4.17.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Cypher Injection vulnerability in Apache Camel camel-neo4j component.
This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0
Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-66169
- https://github.com/apache/camel/pull/20035
- https://github.com/apache/camel/pull/20036
- https://github.com/apache/camel/pull/20037
- https://github.com/apache/camel/commit/66715d3feb4ba15df30cffe437e45efeedfba10d
- https://github.com/apache/camel/commit/723e2cd98ce4b4ceb1dd38837bc113fca0cef170
- https://github.com/apache/camel/commit/e46c4c0ef542a64dc791253763a8273dfd7fb179
- https://camel.apache.org/security/CVE-2025-66169.html
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-22719
- http://www.openwall.com/lists/oss-security/2026/01/13/5