CVE-2026-49365

{"id": "CVE-2026-49365", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49365", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T12:34:23.255778Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Camel", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.14.8", "versionType": "semver"}, {"status": "affected", "version": "4.15.0", "lessThan": "4.18.3", "versionType": "semver"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.21.0", "versionType": "semver"}], "packageName": "org.apache.camel:camel-netty-http", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:38.627", "references": [{"url": "https://camel.apache.org/security/CVE-2026-49365.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/05/25", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component.\n\nThe camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false because the backing field was an uninitialised primitive boolean (Java's default of false), whereas the other Camel HTTP server components (camel-http / camel-jetty / camel-servlet and camel-platform-http) default it to true. With muteException=false, when a request triggers an exception during route processing the consumer writes the full Throwable stack trace into the HTTP response body as text/plain (via DefaultNettyHttpBinding) instead of returning an empty body. Any unauthenticated client that can reach the endpoint and cause a processing error - for example by sending a malformed request body, an invalid parameter, or otherwise triggering a route-internal failure - therefore receives a complete Java stack trace. Such a stack trace can disclose sensitive internal information, including credentials embedded in exception messages, internal host names and IP addresses, filesystem paths, dependency and version details, database and class names, and the application's internal structure, which an attacker can use to plan further attacks.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, set muteException=true explicitly on the camel-netty-http consumer (for example netty-http: http://0.0.0.0:8080/api?muteException=true , or globally via the camel.component.netty-http.configuration.mute-exception=true property), so that processing errors no longer return the stack trace to the client."}, {"lang": "es", "value": "Vulnerabilidad relacionada con la generaci\u00f3n de mensajes de error que contienen informaci\u00f3n confidencial en el componente HTTP Netty de Apache Camel. El consumidor del servidor HTTP camel-netty-http expone una opci\u00f3n denominada muteException que controla lo que se devuelve al cliente cuando se produce un error en el procesamiento de una ruta. Esta opci\u00f3n ten\u00eda como valor predeterminado false porque el campo subyacente era un valor booleano primitivo no inicializado (el valor predeterminado de Java es false), mientras que los dem\u00e1s componentes del servidor HTTP de Camel (camel-http, camel-jetty, camel-servlet y camel-platform-http) lo establecen por defecto en true. Con muteException=false, cuando una solicitud provoca una excepci\u00f3n durante el procesamiento de la ruta, el consumidor escribe el seguimiento completo de la pila de Throwable en el cuerpo de la respuesta HTTP como text/plain (a trav\u00e9s de DefaultNettyHttpBinding), en lugar de devolver un cuerpo vac\u00edo. Cualquier cliente no autenticado que pueda acceder al punto final y provocar un error de procesamiento \u2014por ejemplo, enviando un cuerpo de solicitud mal formado, un par\u00e1metro no v\u00e1lido o provocando de cualquier otra forma un fallo interno de la ruta\u2014 recibir\u00e1, por lo tanto, un seguimiento completo de la pila de Java. Dicha traza de pila puede revelar informaci\u00f3n interna confidencial, incluidas credenciales incrustadas en los mensajes de excepci\u00f3n, nombres de host internos y direcciones IP, rutas del sistema de archivos, detalles de dependencias y versiones, nombres de bases de datos y de clases, y la estructura interna de la aplicaci\u00f3n, que un atacante puede utilizar para planear nuevos ataques. Este problema afecta a Apache Camel: desde la versi\u00f3n 4.0.0 hasta la 4.14.8, desde la 4.15.0 hasta la 4.18.3 y desde la 4.19.0 hasta la 4.21.0. Se recomienda a los usuarios que actualicen a la versi\u00f3n 4.21.0, que corrige el problema. Si los usuarios utilizan las versiones LTS de la rama 4.14.x, se les sugiere que actualicen a la 4.14.8. Si los usuarios utilizan las versiones de la rama 4.18.x, se les sugiere que actualicen a la 4.18.3. En el caso de las implementaciones que no puedan actualizarse de inmediato, establezca expl\u00edcitamente `muteException=true` en el consumidor camel-netty-http (por ejemplo, `netty-http: http://0.0.0.0:8080/api?muteException=true`, o de forma global mediante la propiedad `camel.component.netty-http.configuration.mute-exception=true`), de modo que los errores de procesamiento ya no devuelvan el seguimiento de la pila al cliente."}], "lastModified": "2026-07-09T03:04:17.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7662EB25-EAB6-493F-924C-5CA8A6F462B4", "versionEndExcluding": "4.14.8", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AEE4159-4465-4ACD-B94A-1E4682C85270", "versionEndExcluding": "4.18.3", "versionStartIncluding": "4.15.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C2A1A7A-FADC-470F-8265-FA126AFD94ED", "versionEndExcluding": "4.21.0", "versionStartIncluding": "4.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}