{"answers":{"affected":"6 open source packages ship an affected version, including org.apache.camel:camel-undertow. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-78329 in the wild and no public exploit code.","fix":"Upgrade org.apache.camel:camel-undertow to a fixed version for your release line: 4.14.9, 4.18.4 or 4.22.0.","what":"CVE-2026-78329 is a critical vulnerability in Apache Camel, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-78329 and fix it if it is affected.\n\nWhat it is: CVE-2026-78329 is a critical vulnerability in Apache Camel, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-78329 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.camel:camel-undertow (Maven): affected from 4.11.0; fixed in 4.14.9\n- org.apache.camel:camel-undertow (Maven): affected from 4.11.0; fixed in 4.14.9\n- org.apache.camel:camel-undertow (Maven): affected from 4.15.0; fixed in 4.18.4\n- org.apache.camel:camel-undertow (Maven): affected from 4.15.0; fixed in 4.18.4\n- org.apache.camel:camel-undertow (Maven): affected from 4.19.0; fixed in 4.22.0\n- org.apache.camel:camel-undertow (Maven): affected from 4.19.0; fixed in 4.22.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-78329/ (Markdown: https://insights.sbomify.com/CVE-2026-78329/index.md)","id":"CVE-2026-78329","markdown":"https://insights.sbomify.com/CVE-2026-78329/index.md","name":"CVE-2026-78329","record":{"aliases":["ECHO-6674-10ab-a873","GHSA-v7h8-xhh6-gfj4"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Apache Camel integration framework","requires_auth":"none","summary":"Improper header filtering in Apache Camel Undertow allows attackers to manipulate WebSocket dispatch directives, potentially redirecting messages to unintended peers.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"camel","vendor":"apache"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Improper input validation vulnerability in Apache Camel Undertow component.\n\nThis issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.\n\nUndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed that instance into the UndertowHttpBinding it creates lazily, overwriting the UndertowHeaderFilterStrategy that DefaultUndertowHttpBinding installs in its own constructor. Unless a deployment supplied a custom binding or an explicit headerFilterStrategy, the undertow-specific filtering therefore never executed on endpoint-configured routes: the strategy object was constructed and immediately replaced before it could be consulted. The consequence is that the legacy websocket. Exchange-header prefix was not filtered at the undertow transport boundary in either direction, so an undertow HTTP consumer mapped inbound wire headers of that form onto the Exchange, where an undertow WebSocket producer reads them as dispatch directives and can be made to deliver to a peer other than the one the route selected; and header names that undertow itself does not accept were mapped onto the Exchange rather than being skipped. Rest DSL consumers were never affected, because UndertowComponent assigns UndertowRestHeaderFilterStrategy explicitly, which extends the undertow strategy. This is not a regression of CVE-2025-30177: the base HttpHeaderFilterStrategy configures the inbound Camel-prefix filter itself, so the protection introduced by that advisory continued to work through the base class and was never lost. What the change did was leave the undertow strategy orphaned on the endpoint path, with the effect that two subsequent corrections written into it - one skipping header names undertow rejects, one filtering the legacy websocket. prefix in both directions - were applied to a class the endpoint no longer used and never took effect in the releases that shipped them.\n\nUsers are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, configure the strategy explicitly rather than relying on the default, for example by binding an UndertowHeaderFilterStrategy in the registry and referencing it on the endpoint as undertow:http://0.0.0.0:8080/foo?headerFilterStrategy=#myStrategy, and additionally strip the dispatch headers at the trust boundary with removeHeaders(“websocket.*”). Note a residual limitation that upgrading does not remove: the undertow component deliberately keeps the websocket. values as part of its externally visible API contract, and UndertowProducer reads them with in.getHeader, which does not consult a HeaderFilterStrategy at all. The restored filtering is therefore defence in depth at the undertow transport boundary only. A route that carries an untrusted message from a non-undertow consumer into an undertow producer is not protected by this fix and must strip those headers itself.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":"2026-08-24","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-08-24T15:59:32Z","kind":"github_poc","ref":"https://github.com/oscerd/CVE-2026-78329","stars":0,"title":"Reproducer for CVE-2026-78329 (Apache Camel camel-undertow header filter strategy not applied, websocket.* injection) — Camel Spring Boot"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes","id":"CVE-2026-78329","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":"apache:camel","products":["apache:camel"],"type":"other","year":"2026"},"n_packages":6,"n_references":1,"next":{"headline":"Apache Syncope: Privilege escalation for admin user via JWT authentication","id":"CVE-2026-78330"},"packages":[{"ecosystem":"Maven","fixed":["4.14.9"],"introduced":["4.11.0"],"last_affected":[],"package":"org.apache.camel:camel-undertow","purl":null,"source":"GHSA-v7h8-xhh6-gfj4"},{"ecosystem":"Maven","fixed":["4.14.9"],"introduced":["4.11.0"],"last_affected":[],"package":"org.apache.camel:camel-undertow","purl":"pkg:maven/org.apache.camel/camel-undertow","source":"GHSA-v7h8-xhh6-gfj4"},{"ecosystem":"Maven","fixed":["4.18.4"],"introduced":["4.15.0"],"last_affected":[],"package":"org.apache.camel:camel-undertow","purl":null,"source":"GHSA-v7h8-xhh6-gfj4"},{"ecosystem":"Maven","fixed":["4.18.4"],"introduced":["4.15.0"],"last_affected":[],"package":"org.apache.camel:camel-undertow","purl":"pkg:maven/org.apache.camel/camel-undertow","source":"GHSA-v7h8-xhh6-gfj4"},{"ecosystem":"Maven","fixed":["4.22.0"],"introduced":["4.19.0"],"last_affected":[],"package":"org.apache.camel:camel-undertow","purl":null,"source":"GHSA-v7h8-xhh6-gfj4"},{"ecosystem":"Maven","fixed":["4.22.0"],"introduced":["4.19.0"],"last_affected":[],"package":"org.apache.camel:camel-undertow","purl":"pkg:maven/org.apache.camel/camel-undertow","source":"GHSA-v7h8-xhh6-gfj4"}],"prev":{"headline":"Missing authorization in Network Security Manager (NSM)","id":"CVE-2026-78328"},"products":["Apache Camel"],"published":"2026-08-24","related":[{"cvss_score":10,"headline":"Apache camel-coap allows header injection that can lead to remote code execution","id":"CVE-2026-33453","kev_date_added":null,"published":"2026-04-27"},{"cvss_score":9.9,"headline":"Apache Camel has an incomplete fix for CVE-2025-27636","id":"CVE-2026-40453","kev_date_added":null,"published":"2026-04-27"},{"cvss_score":9.8,"headline":"Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod","id":"CVE-2026-80351","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":9.8,"headline":"Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects","id":"CVE-2026-80352","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":9.8,"headline":"Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection","id":"CVE-2026-71300","kev_date_added":null,"published":"2026-08-24"},{"cvss_score":9.8,"headline":"Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter","id":"CVE-2026-43867","kev_date_added":null,"published":"2026-07-06"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-26","vendors":["Apache Software Foundation"]},"summary":"Improper header filtering in Apache Camel Undertow allows attackers to manipulate WebSocket dispatch directives, potentially redirecting messages to unintended peers.","url":"https://insights.sbomify.com/CVE-2026-78329/"}