GitHub Advisoryadvisory · Maven

GHSA-4jrw-64vr-7g8m Apache Camel camel-neo4j component is vulnerable to cypher injection

MEDIUM Published 2026-01-14 Modified 2026-01-15 Official page ↗
Aliases
CVE-2025-66169
Ecosystem
Maven
Packages
org.apache.camel:camel-neo4j
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-74, CWE-89, CWE-943
Reviewed
2026-01-14

Affected packages

• Maven org.apache.camel:camel-neo4j: >= 4.10.0, < 4.10.8 → fixed in 4.10.8 • Maven org.apache.camel:camel-neo4j: >= 4.14.0, < 4.14.3 → fixed in 4.14.3 • Maven org.apache.camel:camel-neo4j: >= 4.15.0, < 4.17.0 → fixed in 4.17.0

Description

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.

Related

Alias · CVE (1)

  • CVE-2025-66169 Cypher Injection vulnerability in Apache Camel camel-neo4j component. vulnerability

Weakness · CWE (3)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
  • CWE-943 Improper Neutralization of Special Elements in Data Query Logic weakness

References