What is the CVSS score of CVE-2026-49097?

CVE-2026-49097 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel IRC are affected by CVE-2026-49097?

Apache Camel deployments with IRC integration components face an unauthenticated message hijacking vulnerability: attackers can redirect outgoing IRC communications to arbitrary channels or…. A patch is available.

How to fix or mitigate CVE-2026-49097?

Within 24 hours: Identify all production systems running Apache Camel versions 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x with camel-irc components. Within 7 days: Upgrade to patched versions (4.14.8, 4.18.3, or 4.21.0 depending on your current major version branch). Within 30 days: Audit IRC message logs for anomalous routing, review network access controls to IRC bridge endpoints, and validate proper header filtering in all affected systems.

Apache Camel IRC CVE-2026-49097

EUVD-2026-41843 MEDIUM

Improper Input Validation (CWE-20)

2026-07-05

GHSA-463m-2hr2-q2j7

Apache Information Disclosure Microsoft Camel

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-delivered HTTP header injection with no auth required; scope changed as attack crosses HTTP-to-IRC boundary; limited confidentiality and integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:36 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 maven packages depend on org.apache.camel:camel-irc (3 direct, 6 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Header injection in Apache Camel's camel-irc component enables unauthenticated HTTP clients to redirect outgoing IRC messages to attacker-chosen channels or users by supplying non-Camel-prefixed headers (e.g., irc.sendTo) that Camel's HttpHeaderFilterStrategy fails to block. Affected versions span 4.0.0-4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.x; fixes are available in 4.14.8, 4.18.3, and 4.21.0. No public exploit code or CISA KEV listing exists at time of analysis, but the attack requires no credentials when the bridging HTTP consumer is unauthenticated, making it trivially reproducible against any qualifying deployment.

Technical ContextAI

Apache Camel's integration framework routes messages between components via an Exchange object whose headers drive component behavior. The camel-irc component (org.apache.camel:camel-irc) defines ten control headers using raw dot-notation names - irc.sendTo, irc.target, irc.messageType, irc.user.*, irc.num, irc.value - rather than the standard CamelIrc* prefix convention adopted by all other Camel components. Camel's HttpHeaderFilterStrategy, which sanitizes headers arriving at HTTP consumer boundaries, is hardcoded to strip only headers whose names begin with 'Camel' or 'camel'. Because the irc.* namespace does not match this prefix, those headers traverse the HTTP boundary unfiltered and land directly in the Exchange. The camel-irc producer then reads irc.sendTo to override the configured IRC channel destination. This is classified under CWE-20 (Improper Input Validation) and CWE-74 (Injection), and is part of a documented family of non-Camel-prefixed header injection flaws in Apache Camel that includes CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-46454, and CVE-2026-47323.

RemediationAI

The primary fix is to upgrade camel-irc to 4.14.8 (for 4.14.x LTS users), 4.18.3 (for 4.18.x users), or 4.21.0 (for users on the latest stream), as documented in the vendor advisory at https://camel.apache.org/security/CVE-2026-49097.html. After upgrading, any route that sets IRC headers via raw string literals (e.g., 'irc.sendTo') must be updated to use the renamed CamelIrc* constant values (e.g., 'CamelIrcSendTo', 'CamelIrcTarget') - the Java field names are unchanged, so code referencing the constants compiles without modification, but routes injecting raw header strings will silently break until updated. For deployments that cannot upgrade immediately, the vendor-endorsed workaround is to call removeHeaders('irc.*') at the very start of any route that accepts untrusted HTTP input and forwards to an IRC producer; this strips all IRC control headers before the producer can read them. Trade-off: if any trusted upstream legitimately sets irc.* headers, header stripping must be scoped to the untrusted consumer segment only to avoid breaking that logic. Because camel-irc is deprecated, migration away from the component entirely is the recommended long-term path.