CVE-2026-71300: CWE-20 Improper input validation in Apache Software Foundation Apache Camel

The vulnerability arises from improper input validation in the Apache Camel Atmosphere Websocket producer component, specifically in how it processes certain Exchange headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, and websocket.errorType) that control message dispatch to connected WebSocket peers. Because these headers fall outside the Camel namespace filtering, an external HTTP sender can inject or manipulate these headers to alter which clients receive messages. This can suppress notifications intended for one client or redirect them to another client whose connection key is known. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability dates back to the introduction of these constants in version 2.17.0 and was fixed by renaming the header string values into the Camel namespace in the fixed versions. The vendor recommends upgrading to 4.22.0, 4.14.9, or 4.18.4 depending on the release stream. For those who cannot upgrade immediately, removing the dispatch headers (e.g., removeHeaders("websocket.*")) at the trust boundary before the Atmosphere Websocket producer is advised. The fix is a breaking change for routes that set these headers by literal string but not for those referencing the WebsocketConstants symbolically.

An attacker can manipulate WebSocket dispatch headers to control which connected clients receive messages, potentially causing message suppression or delivery to unintended recipients. This compromises confidentiality and integrity of WebSocket communications and can disrupt application logic relying on targeted message delivery. The CVSS score of 9.8 indicates critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Apache Camel versions 4.22.0, 4.14.9, and 4.18.4. Users should upgrade to these versions to remediate the vulnerability. For deployments unable to upgrade immediately, it is recommended to strip the dispatch headers (e.g., removeHeaders("websocket.*")) at the trust boundary before the Atmosphere Websocket producer to prevent untrusted HTTP consumers from influencing WebSocket message dispatch. Note that the fix renames header string values into the Camel namespace, which may break routes that set these headers by literal string; routes using symbolic references to WebsocketConstants are unaffected. Additionally, avoid bridging untrusted HTTP consumers directly into a WebSocket producer whose dispatch is header-driven without stripping dispatch headers first.