CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer CVE-2026-40859 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-netty-http and camel-vertx-http components, tracked as CVE-2026-40859. When a producer endpoint is configured...

CVE-2026-49365

CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Components shown ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

CLEANSTART-2026-XR01746 In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials

Security vulnerability affects the apache-nifi package. In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials...

CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-sensitivity bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while t...

CLEANSTART-2026-VM52152 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the sonarqube package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

camel-netty-http Apache Camel Bypass Security

The vulnerability of the camel-netty-http component of the Apache Camel framework is related to deficiencies in the mechanism for handling registry-dependent data. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

CLEANSTART-2026-GZ46020 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the trino package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-132944

Security vulnerability affects the trino package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CVE-2026-80343

A flaw was found in Apache Camel's Netty HTTP component. Due to inconsistent case-sensitivity handling, security constraint checks evaluate requested URL paths using case-sensitive matching while endpoint dispatch does not. A remote, unauthenticated attacker can exploit this discrepancy by alteri...

io.github.ncasaux:camel-plantuml (>=1.6.0, <=1.8.0), io.github.ncasaux:camel-plantuml-jar (>=1.6.0, <=1.8.0) +12 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-netty-http (>=4.0.0, <=4.18.4)

org.apache.camel:camel-netty-http MAVEN version =4.0.0, =1.6.0, =1.6.0, =1.6.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 Source cves: CVE-2026-78164 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429513...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply...

Improper Neutralization of Special Elements Used in a Template Engine

Overview org.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:itests-netty-http (4.22.0) +7 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-netty-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-netty-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 - org.openehealth.ipf.tutorials:ipf-tutorials-basic 6.0-m1 - org.openehealth.ipf.tutorials:ipf-tutorials-config 6.0-m1 Source cves: CVE-2026-78164 Source advisory:...

Improper Neutralization of Special Elements Used in a Template Engine

Overview org.apache.camel:camel-netty-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers i...

io.github.ncasaux:camel-plantuml (>=1.6.0, <=1.8.0), io.github.ncasaux:camel-plantuml-jar (>=1.6.0, <=1.8.0) +12 more potentially affected by CVE-2026-80343 via org.apache.camel:camel-netty-http (>=4.0.0, <=4.18.4)

org.apache.camel:camel-netty-http MAVEN version =4.0.0, =1.6.0, =1.6.0, =1.6.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 Source cves: CVE-2026-80343 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430141...

Improper Handling of Case Sensitivity

Overview org.apache.camel:camel-netty-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the extractTarget function in the HttpServerChannelHandler...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:itests-netty-http (4.22.0) +7 more potentially affected by CVE-2026-80343 via org.apache.camel:camel-netty-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-netty-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 - org.openehealth.ipf.tutorials:ipf-tutorials-basic 6.0-m1 - org.openehealth.ipf.tutorials:ipf-tutorials-config 6.0-m1 Source cves: CVE-2026-80343 Source advisory:...

CVE-2026-80343

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-78164

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...