Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.camel:camel-undertow

3 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release
4.23.0 (Oct 11, 2026): no advisory affects it
Newest unaffected release
4.23.0 (Oct 11, 2026), the latest release
Advisories
3 · 1 critical, 2 medium
Dependents
3
Releases
218 since 2.16.0 (Oct 5, 2015)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-78329
    Affects 4.11.0 to 4.14.8 (4.14.9 is outside it); 4.15.0 to 4.18.3 (4.18.4 is outside it); 4.19.0 to 4.21.0 (4.22.0 is outside it)
  • CVE-2026-56139
    Affects 4.0.0 to 4.14.7 (4.14.8 is outside it); 4.15.0 to 4.18.2 (4.18.3 is outside it); 4.19.0 to 4.20.0 (4.21.0 is outside it)
  • CVE-2025-30177
    Affects 4.8.0 to 4.8.5 (4.8.6 is outside it); 4.10.0 to 4.10.2 (4.10.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-78329Critical 9.8

    Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the…

    Affected: from 4.11.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0; from 4.11.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0.

    Fixed in 4.14.9 (released Aug 9, 2026, 15 days before disclosure), 4.18.4 (released Aug 10, 2026, 14 days before disclosure) and 4.22.0 (released Aug 7, 2026, 17 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • CVE-2026-56139Medium 5.3

    Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in…

    Affected: from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0; from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0.

    Fixed in 4.14.8 (released Jun 28, 2026, 8 days before disclosure), 4.18.3 (released Jun 28, 2026, 8 days before disclosure) and 4.21.0 (released Jun 27, 2026, 9 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • CVE-2025-30177Medium 6.5

    Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering

    Affected: from 4.10.0, fixed in 4.10.3; from 4.8.0, fixed in 4.8.6; from 4.10.0, fixed in 4.10.3; from 4.8.0, fixed in 4.8.6.

    Fixed in 4.8.6 (released Mar 26, 2025, 6 days before disclosure) and 4.10.3 (released Mar 26, 2025, 6 days before disclosure).

    The latest release, 4.23.0, is not affected.