Severity:
CVSS 3.1: 8.2 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-http) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-http) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-http) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-http) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-http) 4.23.0 unaffected
- Apache Camel (org.apache.camel:camel-http-common) 4.15.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-http-common) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-http-common) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-http-common) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-http-common) 4.23.0 unaffected
- Apache Camel (org.apache.camel:camel-vertx-http) 4.15.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-vertx-http) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-vertx-http) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-vertx-http) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-vertx-http) 4.23.0 unaffected
- Apache Camel (org.apache.camel:camel-undertow) 4.15.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-undertow) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-undertow) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-undertow) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-undertow) 4.23.0 unaffected
- Apache Camel (org.apache.camel:camel-netty-http) 4.15.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-netty-http) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-netty-http) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-netty-http) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-netty-http) 4.23.0 unaffected
Description:
Improper Neutralization of Special Elements Used in a Template Engine and
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
The Camel HTTP producer families let an inbound message override the endpoint
URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that
message-supplied string through CamelContext.resolvePropertyPlaceholders()
before using it. Property-placeholder resolution is a configuration-resolution
facility, not a URI-parsing step: it reaches operating-system environment
variables, JVM system properties, every PropertiesFunction registered on the
classpath - including the AWS, Azure, GCP, HashiCorp, IBM, CyberArk and
Kubernetes secret functions - and, through camel-bean, the invocation of a
no-argument method on any bean in the registry. Applying it to Exchange content
therefore turned a URI string into a configuration- and bean-evaluation
context. A route author opted into none of this: a plain static
to("http://backend/api";) was sufficient. Seven call sites were affected:
HttpHelper.createURL and HttpHelper.createMethod in camel-http-common,
HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in
camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in
camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The
bridgeEndpoint option did not bound the exposure: it suppresses the
CamelHttpUri override in the createURL family but not in the createMethod
family, so a route using the documented bridging configuration still resolved
placeholders taken from the header, and CamelRestHttpUri was consumed before
any bridgeEndpoint check in all four components. Only camel-http offered an
opt-out, skipControlHeaders, which defaults to false. Reaching the headers did
not always require header injection, because several Camel HTTP consumers
populate CamelHttpUri from the request line themselves as a documented
reverse-proxy feature. An unresolvable placeholder additionally produced a
RuntimeExchangeException whose message echoed the URI, which distinguishes a
set from an unset configuration key even where no outbound request is made. The
behaviour predates the 4.x line; it dates back to the camel-http4 and
camel-netty4 components. This advisory continues the alignment CAMEL-24282
applied to the toD and enrich dynamic-URI EIPs in 4.22.0, extending the same
build-time-resolution contract to the HTTP producer components.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If
users are on the 4.22.x releases stream, then they are suggested to upgrade to
4.22.1. If users are on the 4.18.x releases stream, then they are suggested to
upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life
before this issue was resolved and will not receive a fix, so deployments on
those lines must move to a supported release. For deployments that cannot
upgrade immediately, strip the override headers at the trust boundary before
the producer with removeHeader("CamelHttpUri") and
removeHeader("CamelRestHttpUri"), or set skipControlHeaders=true on camel-http
endpoints, which is the only component offering that option. Note that
bridgeEndpoint=true is not a workaround: it suppresses the header override when
the outbound URL is built but not when the header is re-parsed for the query
string. Percent-encoding the placeholder delimiters is likewise not a
mitigation for camel-netty-http, whose binding decodes the request path before
the value reaches the header, so proxy or WAF rules written against the raw
delimiters do not help there. As defence in depth, ensure consumers exposed to
untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel
namespace, and resolve secrets through a vault rather than through environment
variables or system properties that a placeholder can name.
Solution:
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If
users are on the 4.22.x releases stream, then they are suggested to upgrade to
4.22.1. If users are on the 4.18.x releases stream, then they are suggested to
upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life
before this issue was resolved and will not receive a fix, so deployments on
those lines must move to a supported release. For deployments that cannot
upgrade immediately, strip the override headers at the trust boundary before
the producer with removeHeader("CamelHttpUri") and
removeHeader("CamelRestHttpUri"), or set skipControlHeaders=true on camel-http
endpoints, which is the only component offering that option. Note that
bridgeEndpoint=true is not a workaround: it suppresses the header override when
the outbound URL is built but not when the header is re-parsed for the query
string. Percent-encoding the placeholder delimiters is likewise not a
mitigation for camel-netty-http, whose binding decodes the request path before
the value reaches the header, so proxy or WAF rules written against the raw
delimiters do not help there. As defence in depth, ensure consumers exposed to
untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel
namespace, and resolve secrets through a vault rather than through environment
variables or system properties that a placeholder can name.
Work Arounds:
Strip the override headers at the trust boundary before the producer with
removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri"), or set
skipControlHeaders=true on camel-http endpoints, which is the only component
offering that option. bridgeEndpoint=true is not a workaround: it suppresses
the header override when the outbound URL is built but not when the header is
re-parsed for the query string. Percent-encoding the placeholder delimiters is
not a mitigation for camel-netty-http, whose binding decodes the request path
before the value reaches the header.
Credit:
[email protected] (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-78164.html
https://issues.apache.org/jira/browse/CAMEL-24418
https://github.com/apache/camel/pull/25571
https://github.com/apache/camel/commit/ba5aced7f6a1c38a963020575676ad4c76b492cf
https://github.com/apache/camel/commit/9f8a185e315ce9e120889c4106be3dbf4688e507
https://github.com/apache/camel/commit/7cec534c66969015d85e56631143174dd150ed94
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-78164
