CVE-2026-71300

Critical [CVE-2026-55993 +1] Improper input validation vulnerability in Apache Camel Atmosphere Websocket component

CVE-2026-71300Source published Aug 24, 2026Source updated Aug 27, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is delivered to through Exchange headers, and the string values of those headers sat outside the Camel namespace: websocket.connectionKey and websocket.connectionKey.list, along with websocket.sendToAll, websocket.eventType and websocket.errorType. WebsocketEndpoint extends ServletEndpoint and so inherits HttpHeaderFilterStrategy, which filters only the Camel and camel prefixes; the dotted names therefore fell outside the filtered namespace and were admitted in both directions by every HTTP-family…

Affected products in this advisory

• Apache Camel Atmosphere

Source-reported affected versions

• 4.0.0 before 4.14.9
• 4.15.0 before 4.18.4
• 4.19.0 before 4.22.0

Source-reported fixed versions

• 4.14.9
• 4.18.4
• 4.22.0

Mitigation guidance

• Users are recommended to upgrade to version 4.22.0, which fixes the issue.
• If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4.
• For deployments that cannot upgrade immediately, strip the dispatch headers at the trust boundary before the producer, for example with removeHeaders(“websocket.*”) placed between the HTTP consumer and the atmosphere-websocket producer.

1 more entries in the full advisory.