Apache · Apache Camel · CVE-2026-71300
**Name of the Vulnerable Software and Affected Versions**
Apache Camel versions 4.0.0 through 4.14.8
Apache Camel versions 4.15.0 through 4.18.3
Apache Camel versions 4.19.0 through 4.21.9
**Description**
Improper input validation in the Apache Camel Atmosphere Websocket component allows for header injection. The `camel-atmosphere-websocket` producer determines message delivery to WebSocket peers using specific exchange headers: `websocket.connectionKey`, `websocket.connectionKey.list`, `websocket.sendToAll`, `websocket.eventType`, and `websocket.errorType`. Because these headers fall outside the filtered Camel namespace, they are admitted by HTTP-family consumers. In routes bridging an HTTP consumer to an atmosphere-websocket producer, an external sender can supply these headers to manipulate the producer's dispatch decisions. This can lead to notifications being suppressed or delivered to an unintended client. This occurs because the `WebsocketProducer.process()` function prioritizes the list header over the single-key header.
**Recommendations**
Upgrade to version 4.14.9 for those on the 4.14.x LTS releases stream.
Upgrade to version 4.18.4 for those on the 4.18.x releases stream.
Upgrade to version 4.22.0 for all other affected versions.
As a temporary mitigation, strip dispatch headers at the trust boundary before the producer by using `removeHeaders(“websocket.*”)` between the HTTP consumer and the atmosphere-websocket producer.
Avoid bridging an untrusted HTTP consumer directly into a WebSocket producer whose dispatch is header-driven without first stripping the dispatch namespace.