CVE-2026-49097: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header (the constant IrcConstants.IRC_SEND_TO, value irc.sendTo); when that header is present it overrides the channel list configured on the endpoint, and the message is sent only to the specified destination. This and the component's other control headers (irc.target, irc.messageType, irc.user.*, irc.num, irc.value) used plain, non-Camel-prefixed values. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into an irc: producer, any HTTP client could therefore set the irc.sendTo header and redirect a message that the route intended for a configured channel to an arbitrary IRC channel or user - exfiltrating the message content to an attacker-chosen nickname, leaking it into a public channel, or delivering messages that appear to come from the bot. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that set IRC headers via the raw header names must use the CamelIrc* names (for example CamelIrcSendTo) instead of the old irc.* values. For deployments that cannot upgrade immediately, strip the irc.* headers from any untrusted ingress before the irc: producer (for example removeHeaders('irc.*') at the start of the route), and set the IRC destination from a trusted source.
AI Analysis
Technical Summary
The vulnerability in Apache Camel's IRC component arises because the component's control headers (such as irc.sendTo) use plain, non-Camel-prefixed names that bypass the HttpHeaderFilterStrategy on HTTP boundaries. This allows an unauthenticated HTTP client to set the irc.sendTo header and redirect outgoing IRC messages to arbitrary destinations, potentially exfiltrating message content or impersonating the bot. The issue affects Apache Camel versions from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0. The recommended fix is upgrading to 4.21.0 or the appropriate LTS patch versions. For those unable to upgrade immediately, removing irc.* headers from untrusted ingress before the irc: producer is advised.
Potential Impact
An attacker controlling an HTTP client can redirect IRC messages intended for configured channels to arbitrary IRC channels or users without needing credentials. This can lead to message content leakage, unauthorized message delivery, and impersonation of the IRC bot. The vulnerability affects message confidentiality and integrity in routes bridging HTTP consumers to IRC producers.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.14.8, 4.18.3, and 4.21.0. Users should upgrade to these versions to resolve the issue. After upgrading, routes must use Camel-prefixed IRC headers (e.g., CamelIrcSendTo) instead of the old irc.* headers. For deployments that cannot upgrade immediately, it is recommended to strip irc.* headers from any untrusted ingress before the irc: producer (e.g., using removeHeaders('irc.*')) and set IRC destinations from trusted sources.
CVE-2026-49097: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel
Description
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header (the constant IrcConstants.IRC_SEND_TO, value irc.sendTo); when that header is present it overrides the channel list configured on the endpoint, and the message is sent only to the specified destination. This and the component's other control headers (irc.target, irc.messageType, irc.user.*, irc.num, irc.value) used plain, non-Camel-prefixed values. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into an irc: producer, any HTTP client could therefore set the irc.sendTo header and redirect a message that the route intended for a configured channel to an arbitrary IRC channel or user - exfiltrating the message content to an attacker-chosen nickname, leaking it into a public channel, or delivering messages that appear to come from the bot. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that set IRC headers via the raw header names must use the CamelIrc* names (for example CamelIrcSendTo) instead of the old irc.* values. For deployments that cannot upgrade immediately, strip the irc.* headers from any untrusted ingress before the irc: producer (for example removeHeaders('irc.*') at the start of the route), and set the IRC destination from a trusted source.
Affected software
pkg:maven/org.apache.camel/camel-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache Camel's IRC component arises because the component's control headers (such as irc.sendTo) use plain, non-Camel-prefixed names that bypass the HttpHeaderFilterStrategy on HTTP boundaries. This allows an unauthenticated HTTP client to set the irc.sendTo header and redirect outgoing IRC messages to arbitrary destinations, potentially exfiltrating message content or impersonating the bot. The issue affects Apache Camel versions from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0. The recommended fix is upgrading to 4.21.0 or the appropriate LTS patch versions. For those unable to upgrade immediately, removing irc.* headers from untrusted ingress before the irc: producer is advised.
Potential Impact
An attacker controlling an HTTP client can redirect IRC messages intended for configured channels to arbitrary IRC channels or users without needing credentials. This can lead to message content leakage, unauthorized message delivery, and impersonation of the IRC bot. The vulnerability affects message confidentiality and integrity in routes bridging HTTP consumers to IRC producers.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.14.8, 4.18.3, and 4.21.0. Users should upgrade to these versions to resolve the issue. After upgrading, routes must use Camel-prefixed IRC headers (e.g., CamelIrcSendTo) instead of the old irc.* headers. For deployments that cannot upgrade immediately, it is recommended to strip irc.* headers from any untrusted ingress before the irc: producer (e.g., using removeHeaders('irc.*')) and set IRC destinations from trusted sources.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-05-27T11:43:12.917Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b6cae27e9c79719252382
Added to database: 07/06/2026, 08:51:58 UTC
Last enriched: 07/06/2026, 09:07:32 UTC
Last updated: 07/06/2026, 15:34:45 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.