Improper Input Validation in Apache Camel's Undertow Component

CVE-2026-78329

What is CVE-2026-78329?

An improper input validation vulnerability in the Undertow component of Apache Camel allows unauthorized header manipulation. The default headerFilterStrategy configuration leads to failure in applying specific filtering rules on endpoint-configured routes, resulting in legacy websocket headers being processed inappropriately. Without a custom binding, inbound headers may be mapped incorrectly, posing a risk of misdirected messages. Users are advised to upgrade to version 4.22.0 or, if using LTS, to 4.14.9 or 4.18.4 as necessary. Alternatively, explicit configuration of the header filter strategy is recommended to mitigate this vulnerability.

References