Skip to content
VulniPulse
Medium6.5Apache Software Foundation

Medium [CVE-2026-49097] Apache Camel: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component…

This medium-severity Apache Software Foundation advisory covers CVE-2026-49097 affecting Apache Camel IRC.

CVE-2026-49097 Published Jul 6, 2026Updated by vendor Jul 8, 2026
Affected products & platforms
Apache Software FoundationMessaging
Open vendor advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Summary

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component.

The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header (the constant IrcConstants.IRC_SEND_TO, value irc.sendTo); when that header is present it overrides the channel list configured on the endpoint, and the message is sent only to the specified destination.

This and the component's other control headers (irc.target, irc.messageType, irc.user.*, irc.num, irc.value) used plain, non-Camel-prefixed values.

Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange.

In a route that bridges an HTTP consumer (for example platform-http) into an irc: producer, any HTTP client could therefore set the irc.sendTo header and redirect a message that the route intended for a configured channel to an arbitrary IRC channel or user - exfiltrating the message content to an attacker-chosen nickname, leaking it into a public channel, or delivering messages that appear to come from the bot.

No credentials are required when the bridging consumer is unauthenticated.

Affected versions
  • 4.0.0 through 4.14.8
  • 4.15.0 through 4.18.3
  • 4.19.0 through 4.21.0.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions
  • 4.21.0
  • 4.14.8
  • 4.18.3

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 4.21.0, which fixes the issue.
  • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
  • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
  • For deployments that cannot upgrade immediately, strip the irc.* headers from any untrusted ingress before the irc: producer (for example removeHeaders('irc.*') at the start of the route), and set the IRC destination from a trusted source.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.