CVE-2026-55993: Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery

Critical [CVE-2026-55993 +1] Improper input validation vulnerability in Apache Camel Atmosphere Websocket component

CVE-2026-71300Source published Aug 24, 2026Source updated Aug 27, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is delivered to through Exchange headers, and the string values of those headers sat outside the Camel namespace: websocket.connectionKey and websocket.connectionKey.list, along with websocket.sendToAll, websocket.eventType and websocket.errorType. WebsocketEndpoint extends ServletEndpoint and so inherits HttpHeaderFilterStrategy, which filters only the Camel and camel prefixes; the dotted names therefore fell outside the filtered namespace and were admitted in both directions by every HTTP-family…

Affected products in this advisory

• Apache Camel Atmosphere

Source-reported affected versions

• 4.0.0 before 4.14.9
• 4.15.0 before 4.18.4
• 4.19.0 before 4.22.0

Source-reported fixed versions

• 4.14.9
• 4.18.4
• 4.22.0

Mitigation guidance

• Users are recommended to upgrade to version 4.22.0, which fixes the issue.
• If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4.
• For deployments that cannot upgrade immediately, strip the dispatch headers at the trust boundary before the producer, for example with removeHeaders(“websocket.*”) placed between the HTTP consumer and the atmosphere-websocket producer.

1 more entries in the full advisory.

High [CVE-2026-55993] Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…

CVE-2026-55993Source published Jul 6, 2026Source updated Jul 9, 2026

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (WebsocketConsumer.sendEventNotification() iterates the query-string map collected in WebsocketConsumer.service() and copies each entry into the Exchange). Because nothing blocked the Camel header namespace, a client connecting to the WebSocket endpoint could set Camel-internal control headers - including CamelHttpUri (Exchange.HTTP_URI) - simply by supplying them as query parameters. In a route where the WebSocket consumer feeds a downstream HTTP…

Affected products in this advisory

• Apache Camel

Source-reported affected versions

• 4.0.0 through 4.14.8
• 4.15.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.14.8
• 4.18.3

Mitigation guidance

• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
• The fix makes the consumer apply the HeaderFilterStrategy it already inherits from the HTTP/servlet stack, filtering the Camel header namespace case-insensitively on inbound mapping, so externally-supplied Camel* / camel* headers are no longer copied into the Exchange.

1 more entries in the full advisory.