CVE-2026-49097

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description An injection issue exists in the Apache Camel IRC component due to improper input validation and neutralization of special elements. The camel-irc producer determines the destination of outgoing IRC messages using the irc.sendTo Exchange header. Because this header and other control headers—including irc.target, irc.messageType, irc.user.*, irc.num, and irc.value—do not use the required Camel prefix, they bypass the HttpHeaderFilterStrategy when passing through an HTTP boundary. In routes bridging an HTTP consumer to an irc: producer, an unauthenticated HTTP client can manipulate the irc.sendTo header to redirect messages to an arbitrary IRC channel or user. This can lead to the exfiltration of message content to an attacker-controlled nickname, leakage into public channels, or the delivery of messages that falsely appear to originate from the bot.

Recommendations Upgrade Apache Camel versions 4.0.0 through 4.14.7 to version 4.14.8. Upgrade Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Upgrade Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. After upgrading, update routes that set IRC headers to use CamelIrc* names (e.g., CamelIrcSendTo) instead of irc.* values. As a temporary mitigation, strip irc.* headers from untrusted ingress before they reach the irc: producer by using removeHeaders('irc.*') at the start of the route and ensure the IRC destination is set from a trusted source.