CVE-2026-71300: Apache Camel Atmosphere WebSocket header injection in producer dispatch

CVE-2026-71300 · Severity: critical · CVSS 9.8 · Published 2026-08-24

Apache Camel's Atmosphere WebSocket component is used to send real-time messages to connected WebSocket clients. A vulnerability allows attackers on the network to inject specially crafted HTTP headers that override which WebSocket clients receive messages, potentially suppressing notifications intended for one client or redirecting them to another. This affects integration applications that bridge HTTP requests into WebSocket message delivery, and could lead to information disclosure, message tampering, or service disruption.

Technologies: Apache Camel. Vendors: Apache, Maven.

Quick answers

Is CVE-2026-71300 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71300 being exploited in the wild.
How severe is CVE-2026-71300?
Critical severity, with a CVSS score of 9.8, published 24 August 2026.
Which products and versions are affected?
Apache Camel 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x; org.apache.camel:camel-atmosphere-websocket (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.9.
Is there a fix for CVE-2026-71300?
Yes. org.apache.camel:camel-atmosphere-websocket (Maven): upgrade to 4.14.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71300 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71300?
Check whether you run Apache Camel or org.apache.camel:camel-atmosphere-websocket (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-atmosphere-websocket (Maven): upgrade to 4.14.9 or later
    # set org.apache.camel:camel-atmosphere-websocket to 4.14.9 in your pom.xml or build.gradle

Technical details

The camel-atmosphere-websocket producer uses unfiltered Exchange headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) to determine which connected WebSocket peers receive a message. Because WebsocketEndpoint inherits HttpHeaderFilterStrategy, which only filters "Camel" and "camel" prefixed headers, these dotted-name headers pass through HTTP consumers unchecked. In routes bridging HTTP consumers to WebSocket producers, an attacker can supply a malicious websocket.connectionKey.list header in an ordinary HTTP request to hijack the dispatch decision. The vulnerability stems from improper input validation (CWE-20): the producer does not validate that dispatch-control headers originate from trusted sources. Attack vector is network with no authentication required. Patches are available in versions 4.14.9, 4.18.4, and 4.22.0. The fix renames headers into the Camel namespace, which is a breaking change for routes using literal header strings.

Affected products

  • Apache Camel 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x

Identifiers

  • CVE-2026-71300
  • GHSA-m5r8-w65q-8wjf

Timeline

  • 2026-08-24: disclosed: Published to GitHub Advisory Database
  • 2026-08-24: patched: Fixed in versions 4.14.9, 4.18.4, and 4.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.