CVE-2026-80343

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-80343

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80343.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-80343

Published

2026-10-19T10:27:58Z

Modified

2026-10-21T02:59:57Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Details

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-178"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80343.json"
}

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type

GIT

Repo

https://github.com/apache/camel

Events

Introduced

8d135894cd73970c82da5da0dc71ecc7f5521ad5

Fixed

2a16fcefbc5e4512a80180fae12c1f0f9ca0dff0

Introduced

3e9f3011ad48de66fef582ade9794c7340c23af7

Fixed

c056bef67cdfeffdc0ad7255e5e052cab71f2921

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.18.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.19.0"
                },
                {
                    "fixed":  "4.22.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80343.json"