CVE-2026-78329: CWE-20 Improper input validation in Apache Software Foundation Apache Camel

This vulnerability in Apache Camel's Undertow component is due to improper input validation caused by the UndertowEndpoint defaulting its headerFilterStrategy to the base HttpHeaderFilterStrategy, which overwrites the UndertowHeaderFilterStrategy that performs undertow-specific filtering. As a result, the legacy websocket. Exchange-header prefix is not filtered at the undertow transport boundary, allowing inbound wire headers with that prefix to be mapped onto the Exchange. An undertow WebSocket producer can then read these headers as dispatch directives and potentially deliver messages to unintended peers. The flaw does not affect Rest DSL consumers. The issue is not a regression of CVE-2025-30177 but a separate problem where the undertow-specific filtering strategy was orphaned and never applied in affected releases. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9 (LTS), and 4.18.4. Workarounds include explicitly configuring the headerFilterStrategy and removing websocket.* headers at the trust boundary. However, some websocket. headers remain part of the API contract and are not filtered by the UndertowProducer, so routes receiving untrusted messages from non-undertow consumers must manually strip these headers.

The vulnerability allows improper header filtering in the Undertow component of Apache Camel, which can lead to WebSocket producers delivering messages to unintended peers by interpreting unfiltered legacy websocket. Exchange-header prefixed headers as dispatch directives. This can cause confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.8 (critical). Rest DSL consumers are not affected. The vulnerability affects multiple Apache Camel release streams prior to the fixed versions.

A fix is available by upgrading to Apache Camel version 4.22.0, or to 4.14.9 for the 4.14.x LTS stream, or 4.18.4 for the 4.18.x stream. For deployments unable to upgrade immediately, explicitly configure the UndertowHeaderFilterStrategy by binding it in the registry and referencing it on the endpoint, e.g., undertow:http://0.0.0.0:8080/foo?headerFilterStrategy=#myStrategy. Additionally, strip websocket.* headers at the trust boundary using removeHeaders("websocket.*"). Note that some websocket. headers remain part of the API contract and are not filtered by the UndertowProducer, so routes receiving untrusted messages from non-undertow consumers must manually strip these headers. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required.