Executive brief
Apache Camel's Atmosphere WebSocket component is used to send real-time messages to connected WebSocket clients. A vulnerability allows attackers on the network to inject specially crafted HTTP headers that override which WebSocket clients receive messages, potentially suppressing notifications intended for one client or redirecting them to another. This affects integration applications that bridge HTTP requests into WebSocket message delivery, and could lead to information disclosure, message tampering, or service disruption.
Technical details
The camel-atmosphere-websocket producer uses unfiltered Exchange headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) to determine which connected WebSocket peers receive a message. Because WebsocketEndpoint inherits HttpHeaderFilterStrategy, which only filters "Camel" and "camel" prefixed headers, these dotted-name headers pass through HTTP consumers unchecked. In routes bridging HTTP consumers to WebSocket producers, an attacker can supply a malicious websocket.connectionKey.list header in an ordinary HTTP request to hijack the dispatch decision. The vulnerability stems from improper input validation (CWE-20): the producer does not validate that dispatch-control headers originate from trusted sources. Attack vector is network with no authentication required. Patches are available in versions 4.14.9, 4.18.4, and 4.22.0. The fix renames headers into the Camel namespace, which is a breaking change for routes using literal header strings.
Affected products
- Apache Camel 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x
Timeline
- 2026-08-24: disclosed: Published to GitHub Advisory Database
- 2026-08-24: patched: Fixed in versions 4.14.9, 4.18.4, and 4.22.0