CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-sensitivity bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while t...

Exploit for CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-se...

CVE-2026-49365

CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Components shown ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

CVE-2026-49365 — Updated!

CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Components shown ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

Apache Camel Disclosure Protected Information

The vulnerability of the camel-netty-http and camel-undertow components of the Apache Camel framework is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow an attacker to disclose sensitive information that should be protected...

org.apache.camel.quarkus:camel-quarkus-integration-test-http-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-integration-test-sap-netweaver (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty-http (>=4.19.0, <=4.20.0)

org.apache.camel:camel-netty-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890714...

Deserialization of Untrusted Data

Overview org.apache.camel:camel-netty is a Netty component for Apache Camel. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload th...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-netty-http (4.18.0) +6 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty-http (>=4.15.0, <=4.18.2)

org.apache.camel:camel-netty-http MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890714...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-netty-http (>=4.14.0, <=4.14.5) +6 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty-http (>=4.14.0, <=4.14.7)

org.apache.camel:camel-netty-http MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890714...

org.apache.camel.quarkus:camel-quarkus-integration-test-hl7 (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-integration-test-http-grouped (>=3.35.0, <=3.36.0) +18 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty (>=4.19.0, <=4.20.0)

org.apache.camel:camel-netty MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 and more Source cves: CVE-2026-42527https://vulner...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-netty-kafka-connector (>=4.14.0, <=4.14.5) +26 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty (>=4.14.0, <=4.14.7)

org.apache.camel:camel-netty MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 and more Source cves: CVE-2026-42527https://vulners.com/cve/C...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-netty-http (4.18.0) +6 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-netty-http (>=4.15.0, <=4.18.2)

org.apache.camel:camel-netty-http MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40859 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892562...

io.github.ncasaux:camel-plantuml (>=1.6.0, <=1.8.0), io.github.ncasaux:camel-plantuml-jar (>=1.6.0, <=1.8.0) +14 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-netty-http (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-netty-http MAVEN version =4.0.0-m1, =1.6.0, =1.6.0, =1.6.0, =4.0.0, =4.0.0, =4.7.0, =3.0.0-m1, =3.0.0-rc2, =3.0.0-rc2, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.27.4 and more Source cves: CVE-2026-40859 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892562https://vulners.com/snyk/...

Deserialization of Untrusted Data

Overview org.apache.camel:camel-netty-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ObjectInputFilter VertxHttpHelper.deserializeJavaObjectFromStre...

org.apache.camel.springboot:camel-netty-http-starter (4.19.0) potentially affected by CVE-2026-40859 via org.apache.camel:camel-netty-http (4.19.0)

org.apache.camel:camel-netty-http MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-netty-http and may be impacted: - org.apache.camel.springboot:camel-netty-http-starter 4.19.0 Source cves: CVE-2026-40859 Sour...

io.github.ncasaux:camel-plantuml (>=1.6.0, <=1.8.0), io.github.ncasaux:camel-plantuml-jar (>=1.6.0, <=1.8.0) +14 more potentially affected by CVE-2026-49365 via org.apache.camel:camel-netty-http (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-netty-http MAVEN version =4.0.0-m1, =1.6.0, =1.6.0, =1.6.0, =4.0.0, =4.0.0, =4.7.0, =3.0.0-m1, =3.0.0-rc2, =3.0.0-rc2, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.27.4 and more Source cves: CVE-2026-49365 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892600https://vulners.com/snyk/...

org.apache.camel.quarkus:camel-quarkus-integration-test-http-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-integration-test-sap-netweaver (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-49365 via org.apache.camel:camel-netty-http (>=4.19.0, <=4.20.0)

org.apache.camel:camel-netty-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49365 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892600...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-netty-http (4.18.0) +6 more potentially affected by CVE-2026-49365 via org.apache.camel:camel-netty-http (>=4.15.0, <=4.18.2)

org.apache.camel:camel-netty-http MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-49365 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892600...

Information Exposure

Overview org.apache.camel:camel-netty-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Information Exposure via the muteException handling in the NettyHttpConfiguration and NettyHttpComponent...