CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343

The camel-netty-http component in Apache Camel is vulnerable to a security constraint bypass due to improper handling of case sensitivity (CWE-178 ). The vulnerability exists because the security constraint uses a case-sensitive match against the configured context path, while the request dispatc...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.4.1) +22 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-vertx-http (>=4.0.0, <=4.18.4)

org.apache.camel:camel-vertx-http MAVEN version =4.0.0, =0.3.0, =1.0, =1.0, =4.0.0, =4.7.0, =3.2.0, =3.33.0, =3.33.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.0.0, =4.0.0, =4.18.0, =4.18.4 and more Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164https://vulners.com...

io.github.luigidemasi:camel-jbang-plugin-kit (0.4.0), io.kaoto.forage:camel-jbang-plugin-forage (>=1.5.0, <=1.6.0) +21 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-vertx-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-vertx-http MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.22.0 and more Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

CVE-2026-78164

Apache Camel HTTP producer families (camel-http , camel-http-common , camel-vertx-http , camel-undertow , and camel-netty-http ) are vulnerable to an Information Exposure and Template Injection vulnerability (CWE-1336, CWE-200). The root cause is that these components allow inbound messages to ov...

com.cefriel:camel-chimera-graph (4.6.1), com.cefriel:camel-chimera-mapping-template (4.6.1) +42 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-http MAVEN version =4.19.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =4.1.0 - org.apache.camel.kafkaconnector:camel-chuck-norris-source-kafka-connector 4.22.0 - org.apache.camel.kafkaconnector:camel-earthquake-source-kafka-connector 4.22.0 -...

CVE-2026-78164

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

EUVD-2026-104222

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

io.github.ncasaux:camel-plantuml (>=1.6.0, <=1.8.0), io.github.ncasaux:camel-plantuml-jar (>=1.6.0, <=1.8.0) +12 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-netty-http (>=4.0.0, <=4.18.4)

org.apache.camel:camel-netty-http MAVEN version =4.0.0, =1.6.0, =1.6.0, =1.6.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

ai.wanaku:wanaku-routing-http-service (>=0.0.1, <=0.0.3), ai.wanaku:wanaku-routing-yaml-route-service (>=0.0.1, <=0.0.3) +58 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-http (>=4.0.0, <=4.18.4)

org.apache.camel:camel-http MAVEN version =4.0.0, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =4.0.1, =4.0.1, =4.0.1, =3.2.0, =3.2.0, =3.2.0, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =3.1.2 - io.dscope.camel:ag-ui-yaml-service 1.0.0 and more Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

com.cefriel:camel-chimera-graph (4.6.1), com.cefriel:camel-chimera-mapping-template (4.6.1) +104 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-http-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-http-common MAVEN version =4.19.0, =2.110.0, =2.74.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =1.5.0, =1.5.0, =1.6.0 and more Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

CVE-2026-78164 Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

ai.wanaku:wanaku-routing-http-service (>=0.0.1, <=0.0.3), ai.wanaku:wanaku-routing-yaml-route-service (>=0.0.1, <=0.0.3) +152 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-http-common (>=4.0.0, <=4.18.4)

org.apache.camel:camel-http-common MAVEN version =4.0.0, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =4.0.1, =4.0.1, =4.0.1, =1.1.0, =1.1.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.6.2 and more Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:itests-netty-http (4.22.0) +7 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-netty-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-netty-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 - org.openehealth.ipf.tutorials:ipf-tutorials-basic 6.0-m1 - org.openehealth.ipf.tutorials:ipf-tutorials-config 6.0-m1 Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...

CVE-2026-112103 f3-factory fatfree-core HTTP Client web.php _curl certificate validation

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

CVE-2026-112103 f3-factory fatfree-core HTTP Client web.php _curl certificate validation

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

EUVD-2026-104225

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

CVE-2026-112103

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...