Improper Handling of Case Sensitivity in Apache Camel - CVE-2026-80343
Published: October 23, 2026
Vulnerability identifier: #VU157290
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80343
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security constraints and access protected routes without authorization, potentially exposing sensitive data and permitting restricted operations.
The vulnerability exists due to improper handling of case sensitivity in the Apache Camel Netty HTTP security constraint when comparing request paths against the configured context path. A remote attacker can change the case of a character in a request path segment to evade the case-sensitive security check while routing still dispatches the request to the same protected endpoint, gaining access without satisfying its security constraint.
Affected software
Apache Camel
How to mitigate CVE-2026-80343
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1