Apache Camel CVE-2026-71300: WebSocket Scheduler Header Injection Vulnerability Advisory

APACHE CAMEL SECURITY ADVISORY: CVE-2026-71300 Vulnerability Overview Severity: Medium Summary: WebSocket header injection vulnerability in Camel-Atmosphere-WebSocket. The scheduler selects the target peer via exchange headers; since the names of these headers fall outside the filtered Camel namespace, external senders can hijack scheduling decisions. Description: The Camel-Atmosphere-WebSocket producer determines which connected WebSocket peer receives a message based on exchange headers whose string values lie outside the Camel namespace: and , as well as , , and . extends , thereby inheriting . This strategy only filters headers with Camel or Camel-prefixed dot-notation names. Consequently, names outside the filtered namespace are accepted by every HTTP peer consumer in both directions. When routing bridges an HTTP consumer to an atmosphere-websocket producer, an external sender can supply a list header and hijack the producer's scheduling decisions. processes list headers before single-key headers; thus, injected values can cause the intended recipient to be dropped. A notification intended for a specific client connection may be dropped or sent to another client whose connection key is known to the sender. The header does not need to be a query parameter, nor does it need to be provided as a literal list. Camel's HTTP binding facilitates mapping repeated header names and bracketed values to a List when mapping to the Exchange—so standard inbound HTTP headers are sufficient to reach the list value branch. This differs from CVE-2026-55993, which involved query parameter path handling on the consumer side of the same component. The behavior traces back to the introduction of these constants, first released in version 2.17.0, and remained unchanged until this fix. Affected Versions Affected Versions: 4.0.0 through 4.14.9; 4.15.0 through 4.18.4; 4.19.0 through 4.22.0 Remediation Fixed Versions: 4.14.9, 4.18.4, and 4.22.0 Mitigation: Users are advised to upgrade to 4.22.0, which resolves the issue. If users are on the 4.14.x LTS release stream, they are advised to upgrade to 4.14.9. If users are on the 4.18.x release stream, they are advised to upgrade to 4.18.4. For deployments that cannot upgrade immediately, scheduling headers can be stripped at the trust boundary between the HTTP consumer and the atmosphere-websocket producer, for example, by using placed between the HTTP consumer and the atmosphere-websocket producer. Note that the fix renames the header string values to the Camel namespace, which is a breaking change for routes that set headers via literals: routes referencing fields from are unaffected, and the changes are documented in the upgrade guide. As part of defense in depth, do not directly bridge untrusted HTTP consumers to WebSocket producers whose scheduling is header-driven without stripping the scheduling namespace. References PGP Signed Announcement Data: CVE-2026-71300.txt.asc Mitre CVE Entry: https://www.cve.org/CVERecord?id=CVE-2026-71300

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel CVE-2026-71300: WebSocket Scheduler Header Injection Vulnerability Advisory