CVE-2026-56139

camel-undertow Rest DSL muteException Stack-Trace Disclosure Reproducer CVE-2026-56139 This project demonstrates an information-disclosure issue in Apache Camel's camel-undertow Rest DSL consumer, tracked as CVE-2026-56139. The muteException option controls whether an uncaught processing...

DEBIAN-CVE-2026-114370

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC Run: cd springbootundertowstand or aspnetstand docker compose up --build...

CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final Base Image — CVE-2025-12543 Patch Overview This repository provides a Docker base image built on WildFly 11.0.0.Final with a backported fix for CVE-2025-12543 , a critical Host header validation vulnerability in Undertow. The image is intended to be provided to colleagues as ...

CVE-2026-49365

CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Components shown ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

CVE-2026-114370

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

EUVD-2026-107307

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

CVE-2026-114370 Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

CVE-2026-114370

A flaw exists in the PathResourceManager component of the Undertow web server , which handles serving static files. The vulnerability stems from an inadequate verification mechanism for symbolic links; the system checks if a target path starts with an authorized string but fails to ensure it matc...

CVE-2026-114370 Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

CVE-2026-114370

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

PT-2026-120645

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

undertow-io__undertow_CVE-2014-7816_1-0-16-Final

Undertow Undertow is a Java web server based on non-blocking IO. It consists of a few different parts: A core HTTP server that supports both blocking and non-blocking IO A Servlet 3.1 implementation A JSR-356 compliant web socket implementation Website: http://undertow.io Issues:...

CVE-2026-78329

CVE-2026-78329 — camel-undertow header filter strategy not applied websocket. injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where UndertowEndpoint defaulted its headerFilterStrategy to the base HttpHeaderFilterStrategy and pushed that instance into the...

CVE-2026-78164

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

CVE-2026-78164

Apache Camel HTTP producer families (camel-http , camel-http-common , camel-vertx-http , camel-undertow , and camel-netty-http ) are vulnerable to an Information Exposure and Template Injection vulnerability (CWE-1336, CWE-200). The root cause is that these components allow inbound messages to ov...

EUVD-2026-104222

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

PT-2026-117329

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components contain an issue where inbound messages can override the endpoint URI using...