Apache Camel netty-http Information Disclosure Vulnerability (CVE-2026-49365)

Vulnerability Overview CVE-2026-49365 Severity: Medium Summary: The option in Camel-Netty-HTTP defaults to , resulting in the return of full Java stack traces when handling errors, thereby leaking sensitive internal information to unauthorized clients. Description: The Camel-netty-http HTTP server consumer exposes a option that controls the content returned to clients when routing errors occur. This option defaults to because the backing field is an uninitialized primitive boolean (which defaults to in Java), whereas other Camel HTTP server components (camel-http, camel-jetty, camel-servlet, and camel-platform-http) default to . When , during request routing that triggers an exception, the consumer writes the full stack trace of the Throwables as text/plain (via DefaultNettyHttpBinding) to the HTTP response body, instead of returning an empty response body. Any unauthorized client that reaches the endpoint and causes a processing error (e.g., by sending a malformed request body, invalid parameters, or triggering an internal routing error) will receive the complete Java stack trace. Such stack traces may leak sensitive internal information, including credentials embedded in exception messages, internal hostnames and IP addresses, file system paths, dependency and version details, database and class names, and the internal structure of the application. Attackers can leverage this information for further attacks. Impact Scope Affected Versions: - 4.0.0 to 4.14.8 - 4.15.0 to 4.18.3 - 4.19.0 to 4.21.0 Fix Fixed Versions: 4.14.8, 4.18.3, and 4.21.0 Mitigation Users are advised to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS release stream, it is recommended to upgrade to 4.14.8. If users are on the 4.18.x release stream, it is recommended to upgrade to 4.18.3. For deployments that cannot upgrade immediately, can be set explicitly on the camel-netty-http consumer (e.g., ), or globally via the property. This prevents the consumer from returning stack traces to clients when errors occur. References PGP-signed announcement data: CVE-2026-49365.txt.asc Mitre CVE entry: CVE-2026-49365 Notes The JIRA ticket CAMEL-23651 references various commits addressing this issue and provides more details. The fix was merged into the main branch and backported to camel-4.18.x. The fix aligns the default value of the consumer option for camel-netty-http with other Camel HTTP server components, flipping both from to . This is a behavioral change towards stricter defaults: takes precedence over ; therefore, camel-netty-http routes that previously relied on receiving exceptions (e.g., with ) must now explicitly set (documented in the 4.21 upgrade guide as a potential breaking change). The issue CVE-2026-49365 (generating error messages containing sensitive information) is classified as an insecure information disclosure vulnerability: camel-netty-http defaults to (because the backing field is an uninitialized primitive boolean), whereas camel-http, camel-jetty, camel-servlet, and camel-platform-http default to . The same default issue in camel-undertow is addressed separately under CVE-2026-56135; both announcements share the same fix (CAMEL-23651). Credits This issue was discovered by Yu Bao of PayPal.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel netty-http Information Disclosure Vulnerability (CVE-2026-49365)