CVE-2026-56139: Apache Camel Undertow information disclosure in error messages

CVE-2026-56139 · Severity: medium · CVSS 5.3 · Published 2026-07-06

Apache Camel's Undertow HTTP server component exposes detailed Java error stack traces to clients when processing errors occur, by default. An attacker can send malformed requests to trigger errors and receive sensitive information including hardcoded credentials, internal hostnames, filesystem paths, database names, and application architecture details. This information can be used to plan further attacks against the system.

Technologies: org.apache.camel:camel-undertow (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-56139 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56139 being exploited in the wild.
How severe is CVE-2026-56139?
Medium severity, with a CVSS score of 5.3, published 6 July 2026.
Which products and versions are affected?
Apache Software Foundation Camel Undertow 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.9; org.apache.camel:camel-undertow (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8.
Is there a fix for CVE-2026-56139?
Yes. org.apache.camel:camel-undertow (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56139 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56139?
Check whether you run Apache Software Foundation Camel Undertow or org.apache.camel:camel-undertow (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-undertow (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-undertow to 4.14.8 in your pom.xml or build.gradle

Technical details

This is a generation of error message containing sensitive information vulnerability (CWE-209) in the camel-undertow component. The muteException consumer option, which controls whether detailed exception stack traces are returned to clients, defaulted to false in camel-undertow, contrary to behavior in other Camel HTTP components (camel-http, camel-jetty, camel-servlet, camel-platform-http) which default it to true. With muteException=false, any unauthenticated network client reaching the endpoint can send requests (e.g., malformed body, invalid parameters) to trigger route processing exceptions and receive the full Java stack trace in the HTTP response body. Additionally, for Rest DSL consumers, the muteException option was ignored entirely due to a hard-coded false value in RestUndertowHttpBinding, causing stack traces to be returned even when muteException=true was explicitly configured. Stack traces can leak credentials, internal hostnames, IP addresses, filesystem paths, dependency versions, database names, and structural details of the application.

Affected products

  • Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x

Identifiers

  • CVE-2026-56139
  • GHSA-hjg2-f45w-c566

Timeline

  • 2026-07-06: disclosed: Vulnerability published as CVE-2026-56139 and GHSA-hjg2-f45w-c566
  • 2026-07-06: patched: Fixed in Camel 4.21.0, 4.18.3, and 4.14.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.