CVE-2026-78329
Description
A flaw was found in the Apache Camel Undertow component. Due to improper input validation, the component's header filtering strategy was incorrectly configured, preventing specific Undertow-related header filtering from executing. This oversight allows an attacker to manipulate websocket. prefixed headers, potentially leading to messages being redirected to unintended recipients or bypassing intended header restrictions.
Statement
This vulnerability is rated as Moderate severity because exploitation requires a specific route topology where unvalidated HTTP input directly reaches an Undertow WebSocket producer, limiting the blast radius to unauthorized message delivery or data exposure without enabling remote code execution. In Red Hat integration environments, routes exposed via the Rest DSL are not affected as they configure dedicated header filtering by default. Applications remain at risk only when standard Undertow endpoints process untrusted client requests without custom header filter definitions or explicit header sanitization.
Mitigation
Configure an explicit UndertowHeaderFilterStrategy on the endpoint (e.g. bind an UndertowHeaderFilterStrategy in the registry and reference it on the endpoint as headerFilterStrategy=#myStrategy) and/or strip the dispatch headers at the trust boundary with removeHeaders("websocket.*") before routing to an undertow WebSocket producer. Residual limitation: routes carrying untrusted messages from a non-undertow consumer into an undertow producer are not protected by the fix and must strip those headers themselves. Upgrading to the fixed versions (4.14.9 for the 4.14.x LTS stream, 4.18.4 for the 4.18.x stream, 4.22.0 otherwise) restores UndertowHeaderFilterStrategy as the endpoint default.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
