CVE-2026-71300

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9

Description Improper input validation in the Apache Camel Atmosphere Websocket component allows for header injection. The camel-atmosphere-websocket producer determines message delivery to WebSocket peers using specific exchange headers: websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, and websocket.errorType. Because these headers fall outside the filtered Camel namespace, they are admitted by HTTP-family consumers. In routes bridging an HTTP consumer to an atmosphere-websocket producer, an external sender can supply these headers to manipulate the producer's dispatch decisions. This can lead to notifications being suppressed or delivered to an unintended client. This occurs because the WebsocketProducer.process() function prioritizes the list header over the single-key header.

Recommendations Upgrade to version 4.14.9 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.4 for those on the 4.18.x releases stream. Upgrade to version 4.22.0 for all other affected versions. As a temporary mitigation, strip dispatch headers at the trust boundary before the producer by using removeHeaders(“websocket.*”) between the HTTP consumer and the atmosphere-websocket producer. Avoid bridging an untrusted HTTP consumer directly into a WebSocket producer whose dispatch is header-driven without first stripping the dispatch namespace.