Executive brief
Apache Camel is an integration framework used to connect and route messages between different systems. The IRC component allows Camel routes to send messages to IRC chat channels. When an HTTP endpoint is bridged to an IRC producer, the application's HTTP header filtering fails to block IRC control headers (like irc.sendTo) because they don't use the "Camel" namespace prefix. An unauthenticated attacker can set these headers in HTTP requests to redirect messages to different IRC channels, leak message content to attacker-controlled nicknames, or impersonate the bot. This affects deployments that accept HTTP input and forward messages to IRC.
Technical details
This is a header injection vulnerability (CWE-20: Improper Input Validation) in the Apache Camel IRC component. The root cause is that IRC control headers (irc.sendTo, irc.target, irc.messageType, irc.user.*, irc.num, irc.value) use plain, non-Camel-prefixed names. The HttpHeaderFilterStrategy blocks only the "Camel" / "camel" namespace, so these IRC headers pass through from inbound HTTP requests into the Exchange object untouched. When an HTTP consumer (e.g., platform-http) bridges to an irc: producer, any HTTP client can set arbitrary IRC headers to override the configured destination, redirecting the message to an attacker-specified IRC channel or user. Attack vector is network, no authentication required, and the impact is message exfiltration, public disclosure, or spoofing. Patches: upgrade to 4.14.8, 4.18.3, or 4.21.0, or strip irc.* headers at the start of untrusted routes using removeHeaders('irc.*').
Affected products
- Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: Published to GitHub Advisory Database
- 2026-07-06: patched: Fixes released in versions 4.14.8, 4.18.3, and 4.21.0