CVE-2026-56139: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component
Not in the CISA KEV catalog.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-56139 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 5.3 (Apache), 5.3 (Red Hat)
- Fixed releases
- Apache: 4.21.0, 4.14.8, 4.18.3
- Red Hat: 4.21.0, 4.14, 4.14.8, 4.18, 4.18.3
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-56139; bulletin-wide values are not repeated here.
Is CVE-2026-56139 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-56139 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-56139?
Upgrade to a fixed release named by the vendor:
- Apache: 4.21.0, 4.14.8, 4.18.3
- Red Hat: 4.21.0, 4.14, 4.14.8, 4.18, 4.18.3
- Users are recommended to upgrade to version 4.21.0, which fixes the issue. (Apache)
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. (Apache)
- To mitigate this issue, configure the `camel-undertow` consumer to explicitly set `muteException=true`. This can be done by adding `?muteException=true` to the consumer URI (e.g., `undertow: or by setting the global property `camel.component.undertow.mute-exception=true`. This prevents Java stack traces from being returned in HTTP responses upon route processing errors. Note that this workaround may not apply to Rest DSL consumers in affected releases. A restart of the application or service hosting the Camel Undertow component may be required for the changes to take effect. (Red Hat)
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Vendor advisory comparison
Apache
1 advisory- Advisory severityMedium5.3
Medium [CVE-2026-56139] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component
CVE-2026-56139Source published Source updated
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false, whereas the other Camel HTTP server components (camel-http / camel-jetty / camel-servlet and camel-platform-http) default it to true. With muteException=false, when a request triggers an exception during route processing the consumer writes the full Throwable stack trace into the HTTP response body as text/plain instead of returning an empty body. Any unauthenticated client that can reach the endpoint and cause a processing error - for example by sending a malformed request body, an invalid…
- Affected products in this advisory
- Apache Camel Undertow
- Source-reported affected versions
- 4.0.0 through 4.14.8
- 4.15.0 through 4.18.3
- 4.19.0 through 4.21.0.
- Source-reported fixed versions
- 4.21.0
- 4.14.8
- 4.18.3
- Mitigation guidance
- Users are recommended to upgrade to version 4.21.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
- Workarounds
- For deployments that cannot upgrade immediately, set muteException=true explicitly on the camel-undertow consumer (for example undertow: http://0.0.0.0:8080/api?muteException=true, or globally via the camel.component.undertow.mute-exception=true property), so that processing errors no longer return the stack trace to the client; note that on affected releases this workaround does not cover Rest DSL consumers, whose binding ignores the option until the fix is applied.
Red Hat
1 advisory- Advisory severityMedium5.3
Medium [CVE-2026-56139] Information disclosure via error messages containing sensitive data
CVE-2026-56139Source published Source updated
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false, whereas the other Camel HTTP server components (camel-http / camel-jetty / camel-servlet and camel-platform-http) default it to true. With muteException=false, when a request triggers an exception during route processing the consumer writes the full Throwable stack trace into the HTTP response body as text/plain instead of returning an empty body. Any unauthenticated client that can reach the endpoint and cause a processing error - for example by sending a malformed request body, an invalid…
- Affected products in this advisory
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Single Sign-On 7
- Source-reported affected versions
- < 4.0.0
- < 4.14.8
- < 4.15.0
- < 4.18.3
2 more entries in the full advisory.
- Source-reported fixed versions
- 4.21.0
- 4.14
- 4.14.8
- 4.18
1 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, configure the `camel-undertow` consumer to explicitly set `muteException=true`. This can be done by adding `?muteException=true` to the consumer URI (e.g., `undertow:http://0.0.0.0:8080/api?muteException=true`) or by setting the global property `camel.component.undertow.mute-exception=true`. This prevents Java stack traces from being returned in HTTP responses upon route processing errors. Note that this workaround may not apply to Rest DSL consumers in affected releases. A restart of the application or service hosting the Camel Undertow component may be required for the changes to take effect.
More Apache advisories
- CVE-2026-78329Aug 24, 2026Improper input validation vulnerability in Apache Camel Undertow component
- CVE-2026-90436Nov 6, 2026** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis
- CVE-2026-85111Nov 6, 2026Apache James denial of service
- CVE-2026-85108Nov 6, 2026Apache James Mime4J Core denial of service
- CVE-2026-76168Nov 6, 2026In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect
- CVE-2026-74756Nov 6, 2026Some docker-compose shipped by the project exposes by default Webadmin REST API publically
Follow CVE-2026-56139 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
iPhone and Android apps · New on the App Store
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
