Information disclosure through error messages in Apache Camel
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.
Summary
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false because the backing field was an uninitialised primitive boolean (Java's default of false), whereas the other Camel HTTP server components (camel-http / camel-jetty / camel-servlet and camel-platform-http) default it to true. With muteException=false, when a request triggers an exception during route processing the consumer writes the full Throwable stack trace into the HTTP response body as text/plain (via DefaultNettyHttpBinding) instead of returning an empty body. Any unauthenticated client that can reach the endpoint and cause a processing error - for example by sending a malformed request body, an invalid parameter, or otherwise triggering a route-internal failure - therefore receives a complete Java stack trace. Such a stack trace can disclose sensitive internal information, including credentials embedded in exception messages, internal host names and IP addresses, filesystem paths, dependency and version details, database and class names, and the application's internal structure, which an attacker can use to plan further attacks. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, set muteException=true explicitly on the camel-netty-http consumer (for example netty-http: http://0.0.0.0:8080/api?muteException=true , or globally via the camel.component.netty-http.configuration.mute-exception=true property), so that processing errors no longer return the stack trace to the client.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 | 4.14.8, 4.18.3, 4.21.0 | Patch available | CNA |
| — | org.apache.camel:camel-netty-http (Maven) | 4.0.0 to before 4.14.8 | 4.14.8 | Patch available | GHSA-42q5-xw42-xf9g |
| — | org.apache.camel:camel-netty-http (Maven) | 4.15.0 to before 4.18.3 | 4.18.3 | Patch available | GHSA-42q5-xw42-xf9g |
| — | org.apache.camel:camel-netty-http (Maven) | 4.19.0 to before 4.21.0 | 4.21.0 | Patch available | GHSA-42q5-xw42-xf9g |
- Apache Camel VendorApache Affected 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 Fixed in 4.14.8, 4.18.3, 4.21.0 Patch available CNA
- org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.0.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-42q5-xw42-xf9g
- org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.15.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-42q5-xw42-xf9g
- org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-42q5-xw42-xf9g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.14.8, 4.18.3, 4.21.0
- Fix · GHSA-42q5-xw42-xf9g org.apache.camel:camel-netty-http (Maven) Fixed in 4.14.8 Advisory →
- Fix · GHSA-42q5-xw42-xf9g org.apache.camel:camel-netty-http (Maven) Fixed in 4.18.3 Advisory →
- Fix · GHSA-42q5-xw42-xf9g org.apache.camel:camel-netty-http (Maven) Fixed in 4.21.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache Camel 4.14.8, 4.18.3, 4.21.0
14 records Highest priority Priority MEDIUM 7 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-35614 Improper input validation in Apache CamelPriority MEDIUM 50
- TI-2026-34159 Improper input validation in Apache CamelPriority MEDIUM 50
- TI-2026-34157 Improper input validation in Apache CamelPriority MEDIUM 50
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-49365
- 2026-10-03 Alias added: GHSA-42q5-xw42-xf9g
References
Advisory 3
Other 11
- https://github.com/apache/camel/pull/23913
- https://github.com/apache/camel/pull/23923
- https://github.com/apache/camel/pull/23990
- https://github.com/apache/camel/commit/6cea553aa42ed1326ac57ad800d66674bc453932
- https://github.com/apache/camel/commit/b1badb58a407e4d16c8b6bba81650d4c68e55eaf
- https://github.com/apache/camel/commit/fdcf67a00470783ccb93b948883b6a4c5275aff5
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23651
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-49365 · CVE Program
- CVE-2026-49365 · NVD
- FIRST EPSS
- GHSA-42q5-xw42-xf9g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-49365 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences