CVE-2026-49365

CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Components shown ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

CVE-2026-78329

CVE-2026-78329 — camel-undertow header filter strategy not applied websocket. injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where UndertowEndpoint defaulted its headerFilterStrategy to the base HttpHeaderFilterStrategy and pushed that instance into the...

CVE-2026-56139

camel-undertow Rest DSL muteException Stack-Trace Disclosure Reproducer CVE-2026-56139 This project demonstrates an information-disclosure issue in Apache Camel's camel-undertow Rest DSL consumer, tracked as CVE-2026-56139. The muteException option controls whether an uncaught processing...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply...

com.milesight.beaveriot:application-dev (1.0.0), com.milesight.beaveriot:rule-engine-component (1.0.0) +10 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-undertow (>=4.0.0, <=4.18.4)

org.apache.camel:camel-undertow MAVEN version =4.0.0, =1.3.0, =4.7.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.18.4 Source cves: CVE-2026-78164 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429514...

org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.22.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.22.0) +2 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-undertow (>=4.19.0, <=4.22.0)

org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78164 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429514...

Improper Neutralization of Special Elements Used in a Template Engine

Overview org.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the...

org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.22.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.22.0) +2 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-undertow (>=4.19.0, <=4.22.0)

org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

com.milesight.beaveriot:application-dev (1.0.0), com.milesight.beaveriot:rule-engine-component (1.0.0) +10 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-undertow (>=4.0.0, <=4.18.4)

org.apache.camel:camel-undertow MAVEN version =4.0.0, =1.3.0, =4.7.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.18.4 Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.21.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.21.0) +2 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.19.0, <=4.21.0)

org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-78329 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319259...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation due to improper validation of HTTP headers in the headerFilterStrategy process. An attacker can manipulate HTTP headers to inject unauthorized directives or bypass intended header filtering by sending specially...

org.apache.camel.karaf:camel-undertow (>=4.14.5, <=4.14.7), org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.11.0, <=4.14.8) +3 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.11.0, <=4.14.8)

org.apache.camel:camel-undertow MAVEN version =4.11.0, =4.14.5, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.14.8 Source cves: CVE-2026-78329 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319259...

io.dscope.camel:ag-ui-yaml-service (1.0.0), io.dscope.camel:camel-a2a-component (1.1.0) +8 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.15.0, <=4.18.3)

org.apache.camel:camel-undertow MAVEN version =4.15.0, =1.3.0, =4.18.1, =4.15.0, =4.15.0, =4.15.0, =4.15.0, =4.18.3 Source cves: CVE-2026-78329 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319259...

io.dscope.camel:ag-ui-yaml-service (1.0.0), io.dscope.camel:camel-a2a-component (1.1.0) +8 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.15.0, <=4.18.3)

org.apache.camel:camel-undertow MAVEN version =4.15.0, =1.3.0, =4.18.1, =4.15.0, =4.15.0, =4.15.0, =4.15.0, =4.18.3 Source cves: CVE-2026-78329 Source advisory: OSV:GHSA-V7H8-XHH6-GFJ4...

org.apache.camel.karaf:camel-undertow (>=4.14.5, <=4.14.7), org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.11.0, <=4.14.8) +3 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.11.0, <=4.14.8)

org.apache.camel:camel-undertow MAVEN version =4.11.0, =4.14.5, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.14.8 Source cves: CVE-2026-78329 Source advisory: OSV:GHSA-V7H8-XHH6-GFJ4...

org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.21.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.21.0) +2 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.19.0, <=4.21.0)

org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-78329 Source advisory: OSV:GHSA-V7H8-XHH6-GFJ4...

org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.21.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.21.0) +2 more potentially affected by CVE-2026-78329 via org.apache.camel:camel-undertow (>=4.19.0, <=4.21.0)

org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-78329 Source advisory: GHSA-V7H8-XHH6-GFJ4...

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...

GHSA-V7H8-XHH6-GFJ4 Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...