OSSEVA FOR APACHE CAMEL
Two supported lines. Twelve months each. Hundreds of routes.
Apache Camel maintains only its two most recent LTS releases, each for roughly a year. As of now that is 4.22.0, end of life August 2027, and 4.18.4, end of life February 2027. Every Camel 2.x and 3.x deployment, and every expired 4.x LTS, is running unpatched.
Why now
The support window is one year, and it does not move
Camel's own download page states the policy plainly: LTS releases receive bug and security fixes for up to one year. 4.22.0 was released in August 2026 with end of life in August 2027; 4.18.4 was released in August 2026 with end of life in February 2027. Anything older gets nothing, and the archive page is where those releases go.
Camel 3 to 4 was a breaking migration, and Camel 2 to 3 was worse
Camel 4 moved to Jakarta EE namespaces, requiring every javax import across the route base to change, and raised the Java baseline. Camel 3 had already restructured the component modules. Each jump forces a coordinated change across every route, every custom processor and every test — which is why so many estates stopped at a version and stayed there.
Camel routes sit directly on untrusted input
Camel is the layer parsing the file drops, consuming the queues, calling the partner endpoints and unmarshalling the XML and JSON in between. Advisories in the marshalling components, the HTTP consumers and the expression languages are reachable from exactly the data Camel exists to ingest. It is not an internal-only component even when it is deployed as one.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 2.25.x(Long past upstream EOL — OSSeva patched) | EOL | Clean |
| 3.14.x LTS(Past upstream EOL — OSSeva patched) | EOL | Clean |
| 3.20.x LTS(Past upstream EOL — OSSeva patched) | EOL | Clean |
| 4.4.x LTS(Past upstream EOL — OSSeva patched) | EOL | Clean |
| 4.8.x LTS(Past upstream EOL — OSSeva patched) | EOL | Clean |
| 4.18.x LTS(Upstream EOL Feb 2027) | Extended | Clean |
| 4.22.x LTS(Upstream EOL Aug 2027) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for the Camel LTS line your routes were written against.
- Security backports for Camel 2.x, 3.x and expired 4.x LTS lines
- Component-level patching across the modules you actually use
- Marshalling and expression-language advisory priority coverage
- Maven / Gradle / Spring Boot starter delivery
- Signed artifacts (GPG)
- Route inventory and migration assessment
- 24/7 managed operations
OSSeva Assure
Patch plus a route inventory and a costed path to a supported LTS.
- Everything in Patch
- Full route and component inventory across the estate
- Jakarta namespace migration impact assessment
- Endpoint exposure and credential handling audit
- SOC 2 / HIPAA attestation package
- Staged upgrade plan to a supported LTS line
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 route monitoring, 15-min SLA, named integration engineers.
- Everything in Assure
- 24/7 route throughput, error and dead-letter monitoring
- 15-minute P1 incident response SLA
- Named senior Camel integration engineer
- Error handler and redelivery policy management
- Migration execution to a supported LTS line
- Quarterly route and capacity reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Resolved Camel version across a multi-module build
mvn dependency:tree -Dincludes=org.apache.camel | \
grep -oE 'camel-[a-z0-9-]+:jar:[0-9.]+' | sort -u
# Anything below 4.18 receives no upstream security fixes.
# At runtime, via the Camel management endpoint
curl -s http://localhost:8080/actuator/camelroutes | jq 'length'<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.osseva.camel</groupId>
<artifactId>camel-bom</artifactId>
<version>3.20.9-osseva-1</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<!-- Component coordinates are unchanged; only the BOM moves. -->
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-jackson</artifactId>
</dependency>Migrate from Expired Camel LTS lines and Camel 2.x / 3.x
OSSeva backports security fixes onto the LTS line your routes were written and tested against, so no javax-to-jakarta rewrite is forced by a security deadline. When migration does happen it is scoped from a real route inventory rather than a guess at how many components are in play.
Pricing model
OSSeva for Apache Camel is priced per application estate — not per route, component or message.
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get Apache Camel patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.