Apache Camel’s CXF component can leak sensitive details when an undeclared exception occurs during a SOAP request. The exception message is copied into the SOAP faultstring, and optional stack traces can be included, exposing internal class names, package structures, and other deployment information to an external caller that can trigger a failure. This vulnerability is classified as a CWE‑209 information‑leak weakness and results in an inadvertent disclosure of internal implementation details to an attacker, potentially aiding further exploitation. The impact is limited to information disclosure rather than code execution or denial of service.

The flaw affects Apache Camel versions ranging from 4.0.0 up to (but not including) 4.18.5, and from 4.19.0 up to (but not including) 4.22.1. Users running any of these releases who expose a CXF SOAP consumer are vulnerable. The fix exists in Camel 4.18.5, 4.22.1, and the current 4.23.0 release.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, so the exploit probability cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation in the wild at this time. Attackers would need to be able to provoke the exception in the SOAP service; since the flaw only reveals data already present in an exception, it does not require privileged access but could be leveraged by remote clients to map internal structure or identify potential points of attack.