High

Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

Type: advisorySource: Official CVE List1 source record

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to("http://backend/api") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it su

Announced 19 Oct 2026Source revision 1

Original source ↗

CVE-2026-78164

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-78164

Apache Camel

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Apache Camel

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Apache Camel

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Apache Camel

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Apache Camel

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Camel",
    "versions": [
      {
        "status": "affected",
        "version": "4.0.0",
        "lessThan": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "lessThan": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.23.0",
        "versionType": "maven"
      }
    ],
    "packageURL": "pkg:maven/org.apache.camel/camel-http",
    "packageName": "org.apache.camel:camel-http",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Camel",
    "versions": [
      {
        "status": "affected",
        "version": "4.15.0",
        "lessThan": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "lessThan": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.18.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.22.1",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.23.0",
        "versionType": "semver"
      }
    ],
    "packageName": "org.apache.camel:camel-http-common",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Camel",
    "versions": [
      {
        "status": "affected",
        "version": "4.15.0",
        "lessThan": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "lessThan": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.18.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.22.1",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.23.0",
        "versionType": "semver"
      }
    ],
    "packageName": "org.apache.camel:camel-vertx-http",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Camel",
    "versions": [
      {
        "status": "affected",
        "version": "4.15.0",
        "lessThan": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "lessThan": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.18.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.22.1",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.23.0",
        "versionType": "semver"
      }
    ],
    "packageName": "org.apache.camel:camel-undertow",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Camel",
    "versions": [
      {
        "status": "affected",
        "version": "4.15.0",
        "lessThan": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "lessThan": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.18.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.22.1",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.23.0",
        "versionType": "semver"
      }
    ],
    "packageName": "org.apache.camel:camel-netty-http",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  }
]

Related CVEs: CVE-2026-78164
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #39960 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 10:54:59 GMT
Publisher date: Mon, 19 Oct 2026 10:07:40 GMT

Read the original announcement