The Apache Camel Mina consumer, when an exchange fails, writes the raw exception object back over the TCP socket to the remote peer. This behavior exposes internal exception details—including class names, messages, stack traces, file paths, and host information—especially over textline or object codecs. The result is a detectable leakage of sensitive deployment information that can aid attackers in mapping the system or crafting further exploits. The weakness is an unchecked information disclosure (CWE-209) that compromises confidentiality but does not directly allow code execution or denial of service.

Apache Camel 4.0.0 through 4.18.4, 4.19.x through 4.22.0, and any earlier 4.x releases are vulnerable. Users on the 4.18.x LTS stream must upgrade to 4.18.5; users on the 4.22.x LTS stream must upgrade to 4.22.1; the general issue is fixed starting with 4.23.0.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity, and there is no EPSS score available. It is not listed in the CISA KEV catalog. The likely attack vector is a remote peer that can provoke a fault—such as sending malformed data or triggering a processing exception—to capture the exception data over the network. While the exposure is limited to information disclosure, the attacker can gain useful details about the application codebase and environment, potentially facilitating further attacks.