CVE-2026-80343: CWE-178 Improper Handling of Case Sensitivity in Apache Software Foundation Apache Camel

The vulnerability arises because Apache Camel's camel-netty-http component applies a case-sensitive comparison for security constraints on request paths, but the routing dispatch uses a case-insensitive comparison. This inconsistency allows an external attacker to modify the case of characters in a request path segment to bypass security constraints, accessing protected routes without credentials or prior access. The issue affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The vendor fixed the issue in versions 4.18.5, 4.22.1, and 4.23.0 by ensuring the security constraint matches the request path using the same case rules as the dispatch. For environments that cannot upgrade immediately, it is advised to place authorization controls in front of the Camel consumer, such as a reverse proxy that normalizes request paths.

An attacker can bypass security constraints protecting routes in Apache Camel's Netty HTTP component by exploiting inconsistent case sensitivity handling. This allows unauthorized access to protected endpoints without requiring credentials or special configuration, potentially exposing sensitive functionality or data. The CVSS score of 8.2 reflects high impact on confidentiality with limited impact on integrity and no impact on availability.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, to 4.22.1 if using the 4.22.x LTS stream, or to 4.23.0 or later for other versions. These versions fix the case sensitivity mismatch in security constraints. If immediate upgrade is not possible, place authorization controls in front of the Camel consumer, such as a reverse proxy that normalizes request paths before forwarding, to prevent bypass of security constraints.