IT SBIT Services
Schneeberger
DEEN
CVE tracker

Apache Camel netty-http: Security constraint bypass through path case mismatch

CVE-2026-80343High 8.2Public exploit

← All vulnerabilities

Summary

The security constraint of the camel-netty-http component compares the request path case-sensitively, while request dispatch does not. A remote attacker who can reach the consumer without credentials can change the case of a path segment so that the constraint is skipped and a protected route is still reached. The vendor rates this CVSS 8.2 (High) and states that no prior access or special configuration is required.

Affected

  • Apache Camel from 4.0.0 before 4.18.5
  • Apache Camel from 4.19.0 before 4.22.1
  • Apache Camel 4.14.x is end of life and receives no fix

Fixed in

  • Apache Camel 4.23.0 (recommended)
  • Apache Camel 4.18.5 for the 4.18.x LTS stream
  • Apache Camel 4.22.1 for the 4.22.x LTS stream

Workaround

  • Upgrade is the only complete fix.
  • If an upgrade is not possible immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding (vendor suggestion, not tested here).

Exploitation

  • CISA SSVC (CISA-ADP): exploitation none, automatable yes, technical impact partial.
  • Not listed in CISA KEV.
  • A public reproducer exists on GitHub.
  • No reports of in-the-wild exploitation found.

Our recommendation

  • Identify all Camel applications and their camel-netty-http versions, including 4.14.x.
  • Upgrade to 4.23.0, or to 4.18.5 or 4.22.1 on the LTS lines.
  • Prioritise systems reachable from the internet.
  • Check whether any protected route relies on the context-path constraint.
  • Verify the fix in a test environment before rolling out to production.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:47.

Original description (NVD)

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed