Input validation error in Apache Camel - CVE-2026-49097
Published: August 24, 2026
Vulnerability identifier: #VU144691
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49097
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect outgoing IRC messages to arbitrary channels or users.
The vulnerability exists due to improper input validation in the Camel IRC component control header handling when processing inbound HTTP requests bridged to an irc: producer. A remote attacker can send a specially crafted HTTP request with irc.* headers to redirect outgoing IRC messages to arbitrary channels or users.
The issue occurs because non-Camel-prefixed IRC control headers can pass through the HTTP header filter and override the configured IRC destination.
Affected software
Apache Camel
How to mitigate CVE-2026-49097
Install security update from vendor's website.
Apache Camel - addressed in versions 4.15.0, 4.19.0, 4.21.0