CVE-2026-49042: LangChain — HIGH

Q: Is CVE-2026-49042 actively exploited?

No confirmed active exploitation of CVE-2026-49042 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-49042?

Update to patched version: LangChain 4.18.3, LangChain 4.18.3, LangChain 4.18.3.

Q: What is the CVSS score for CVE-2026-49042?

CVE-2026-49042 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.69%.

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	maven	>= 4.8.0, < 4.18.3	`4.18.3`
144.8K OpenSSF 5.9 3.0K dependents Pushed 6d ago 27% patched ~187d to patch Full package profile →
LangChain	maven	>= 4.8.0, < 4.18.3	`4.18.3`
144.8K OpenSSF 5.9 3.0K dependents Pushed 6d ago 27% patched ~187d to patch Full package profile →
LangChain	maven	>= 4.8.0, < 4.18.3	`4.18.3`
144.8K OpenSSF 5.9 3.0K dependents Pushed 6d ago 27% patched ~187d to patch Full package profile →

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

Patch available

Update LangChain to version 4.18.3

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-49042?

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

Is CVE-2026-49042 actively exploited?

No confirmed active exploitation of CVE-2026-49042 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-49042?

Update to patched version: LangChain 4.18.3, LangChain 4.18.3, LangChain 4.18.3.

What is the CVSS score for CVE-2026-49042?

CVE-2026-49042 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.69%.

What are the technical details?

Original Advisory

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

Weaknesses (CWE)

CWE-20 Improper Input Validation Primary

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.