Skip to content
VulniPulse
Sign in
Advisory severityMedium6.5Apache Software Foundation

Medium [CVE-2026-49097] Apache Camel: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component…

This medium-severity Apache Software Foundation advisory covers CVE-2026-49097 affecting Apache Camel IRC.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-49097 Source published Source updated

VulniPulse record published Record updated

CVE-2026-49097
Affected products & platforms
Apache Software FoundationMessaging
Open source advisory

Summary

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component.

The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header (the constant IrcConstants.IRC_SEND_TO, value irc.sendTo); when that header is present it overrides the channel list configured on the endpoint, and the message is sent only to the specified destination.

This and the component's other control headers (irc.target, irc.messageType, irc.user.*, irc.num, irc.value) used plain, non-Camel-prefixed values.

Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange.

In a route that bridges an HTTP consumer (for example platform-http) into an irc: producer, any HTTP client could therefore set the irc.sendTo header and redirect a message that the route intended for a configured channel to an arbitrary IRC channel or user - exfiltrating the message content to an attacker-chosen nickname, leaking it into a public channel, or delivering messages that appear to come from the bot.

No credentials are required when the bridging consumer is unauthenticated.

Is CVE-2026-49097 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-49097 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-49097?

Upgrade to a fixed release named by Apache:

  • 4.21.0
  • 4.14.8
  • 4.18.3

Confirm against the vendor advisory before you patch.

Affected versions
  • 4.0.0 through 4.14.8
  • 4.15.0 through 4.18.3
  • 4.19.0 through 4.21.0.

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Fixed versions
  • 4.21.0
  • 4.14.8
  • 4.18.3

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 4.21.0, which fixes the issue.
  • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
  • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
  • For deployments that cannot upgrade immediately, strip the irc.* headers from any untrusted ingress before the irc: producer (for example removeHeaders('irc.*') at the start of the route), and set the IRC destination from a trusted source.

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Get an email when Apache Messaging (ActiveMQ/Kafka/Pulsar) publishes the next one.

See Apache Messaging (ActiveMQ/Kafka/Pulsar)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache Messaging (ActiveMQ/Kafka/Pulsar)

More Apache Software Foundation advisories

All Apache Software Foundation advisories

iPhone and Android apps · New on the App Store

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Download on the App StoreGet CVE alerts on AndroidSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.