HighPublic exploitVulnerability

CVE-2026-80343

Security Constraint Bypass in Apache Camel Netty HTTP

Published Oct 19, 2026 · Updated 3 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

7 mentions · peak 3 in a dayToday

CVSS8.2High · v3.1

EPSS0.52%44th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendor: Apache Software Foundation

IdentifiersCVE-2026-80343CWE-178 · Improper Handling of Case…

CVE-2026-80343 is a security constraint bypass vulnerability in Apache Camel's camel-netty-http component affecting versions 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1. The security constraint compares the request path against the configured context path case-sensitively, while endpoint dispatch uses different case-matching rules. An unauthenticated caller can change the case of a character in a request-path segment, causing the security constraint to skip protection while routing still dispatches the request to the protected endpoint.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Unauthenticated remote attackers can access protected routes without satisfying their configured security constraints. Consequences depend on the functionality exposed by those routes and may include disclosure of protected information and unauthorized operations. The published CVSS 3.1 assessment rates the vulnerability High at 8.2, with high confidentiality impact, low integrity impact, and no availability impact.

Mitigation

If you can’t patch tonight, do this now.

If upgrading immediately is not possible, enforce authorization before requests reach the Camel consumer, such as through a reverse proxy that normalizes request paths before forwarding and applies authorization consistently to the normalized paths.

Remediation

Patch, then assume compromise.

Upgrade to Apache Camel 4.23.0 or later, or the fixed LTS releases 4.18.5 and 4.22.1 for their respective release streams. These releases align security-constraint path matching with the case rules used by endpoint dispatch. The end-of-life 4.14.x stream does not receive the fix; migrate those deployments to a supported fixed release.

Public exploits

Exploits

1 exploit validated by Mallory's analysis.

View more in app →

CVE-2026-80343The repository contains two standalone Java 17 reproducer applications for a claimed Apache Camel camel-netty-http case-sensitivity authentication bypass, identified in the supplied material as CVE-2026-80343 / CWE-178. It is not an exploit-framework module. Its 21 files comprise nine Java source files, two Maven POMs, two Dockerfiles, two Compose definitions, two application-properties files, three READMEs, and a .gitignore. The Spring Boot module uses Spring Boot 3.5.13 and Camel 4.22.0; the Quarkus module uses Quarkus and Camel Quarkus 3.29.0, documented as bundling Camel 4.15.0. Both create an equivalent protected Netty HTTP consumer and an always-rejecting authenticator. Their attack handlers issue two hardcoded local HTTP requests: /app/secret as a control and /App/secret as the bypass attempt. The stated mechanism is inconsistent context-path normalization: case-sensitive stripping causes the altered path to evade the relative security inclusions, while routing still selects the protected consumer. The implementation actively attempts the bypass and returns a synthetic protected body, rather than merely checking version information. Its payload is basic and hardcoded, with no arbitrary target option or post-exploitation capability. Docker Compose publishes only port 8080; port 8081 remains reachable inside the container network, although the consumer binds to all interfaces. No external callback, command execution, credential theft, or destructive behavior appears in the supplied code. Success requires a 401 baseline and the protected marker in the attack response; the code does not explicitly require an attack status of 200. It also labels any marker-free attack response after a 401 baseline as patched, which is stronger than the evidence warrants. Some Spring Boot comments and an inconclusive-result string refer to obsolete /admin paths; executable routes and requests consistently use /app/secret. The README claims affected ranges of 4.0.0 through versions before 4.18.5 and 4.19.0 through versions before 4.22.1, with fixes in 4.18.5, 4.22.1, and 4.23.0. It documents patched controls using Camel 4.22.1 and Camel Quarkus 3.40.0. These vulnerability, version, and fix claims were not independently verified, and the code was not executed. Advisory and JIRA URLs are documentation references, not runtime calls. Repository URL, git reference, and archive size were not supplied; empty strings and zero represent unavailable metadata.oscerd · Disclosed Oct 18, 2026 · java · webOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationCamelapplication

External references

References

MITRE CVEcve.org · CVE-2026-80343 NVDnvd.nist.gov/vuln/detail/CVE-2026-80343 MITRE CWE · CWE-178Improper Handling of Case Sensitivity camel.apache.orgcamel.apache.org/security/CVE-2026-80343.html github.comgithub.com/apache/camel/pull/25578 github.comgithub.com/apache/camel/pull/25761 github.comgithub.com/apache/camel/pull/25762 issues.apache.orgissues.apache.org/jira/browse/CAMEL-24412

Activity feed

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

ghsa syntheticNews · Oct 19, 2026GHSA-pvjg-pwh7-34pjAn authorization bypass in Apache Camel's Netty HTTP component results from inconsistent path case handling between security constraints and request routing. An unauthenticated external caller can change the case of a path character to bypass the security constraint while still reaching the protected endpoint. Affected versions are 4.0.0 through versions before 4.18.5, and 4.19.0 through versions before 4.22.1. Fixes are available in 4.18.5, 4.22.1, and 4.23.0. As an interim mitigation, enforce authorization before the Camel consumer, such as through a reverse proxy that normalizes request paths before forwarding.Read more ↗cvefeed high severityNews · Oct 19, 2026CVE-2026-80343 - Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingA security-constraint bypass in Apache Camel's Netty HTTP component allows an unauthenticated remote caller to reach protected routes by changing the case of characters in a request path. Inconsistent case handling between authorization checks and endpoint routing causes the security constraint to be skipped. The content lists affected versions as 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1. The vulnerability has a CVSS 3.1 score of 8.2 (High). Fixes are available in 4.18.5, 4.22.1, and 4.23.0 or later. As a workaround, enforce authorization before the Camel consumer, such as through a reverse proxy that normalizes request paths.Read more ↗camel apacheNews · Oct 15, 2026Apache Camel Security Advisory - CVE-2026-80343 - Apache CamelA security constraint bypass in Apache Camel's camel-netty-http component allows an unauthenticated external caller to reach a protected route by changing the case of characters in its request path. The mismatch between security constraint matching and route dispatch permits access without satisfying the constraint. Fixed releases are 4.23.0, 4.22.1, and 4.18.5. The end-of-life 4.14.x line does not receive the fix and requires migration to 4.18.5 or later. As an interim mitigation, enforce authorization before requests reach the Camel consumer, such as through a reverse proxy that normalizes request paths.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity3Community discussion across Reddit, Mastodon, and other social sources.