What is the CVSS score of CVE-2026-56139?

CVE-2026-56139 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-56139?

Apache Camel's undertow HTTP server component (versions 4.0.0-4.21.0) discloses complete Java stack traces to unauthenticated attackers through exception handling, exposing system architecture,…. A patch is available.

How to fix or mitigate CVE-2026-56139?

Within 24 hours: Inventory all Apache Camel deployments and identify instances running camel-undertow component in versions 4.0.0-4.21.0. Within 7 days: Apply compensating controls listed below to all affected systems. Within 30 days: Monitor Apache Camel security advisories for patch availability and plan upgrade to patched version once released.

Apache Camel CVE-2026-56139

EUVD-2026-41851 MEDIUM

Error Message Information Leak (CWE-209)

2026-07-05

GHSA-hjg2-f45w-c566

Apache Java Information Disclosure Camel Red Hat

5.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable HTTP endpoint requires no authentication (PR:N, AV:N, AC:L), but impact is limited to partial information disclosure (C:L) with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 21:22 NVD

5.3 (MEDIUM)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:20 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 maven packages depend on org.apache.camel:camel-undertow (4 direct, 5 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 5

medium.com CVE-2026-56139: Apache Camel Undertow Component Exposes Sensitive Info via Error Messages Jul 28, 2026 News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Information disclosure in Apache Camel's camel-undertow HTTP server consumer (versions 4.0.0 through 4.21.0) exposes complete Java stack traces to unauthenticated HTTP clients whenever a route processing exception occurs, due to a misconfigured default and a code-level bypass. Unlike every other Camel HTTP server component (camel-http, camel-jetty, camel-servlet, camel-platform-http), all of which default muteException to true, camel-undertow defaulted this option to false - and for Rest DSL consumers the option was silently ignored entirely due to a hard-coded false in RestUndertowHttpBinding, meaning muteException=true gave false confidence without actual protection. No public exploit has been identified at time of analysis; however exploitation requires only the ability to send a malformed HTTP request to a reachable endpoint, making this trivially accessible to any network-level attacker.

Technical ContextAI

Apache Camel is a widely-deployed Java integration framework built on Enterprise Integration Patterns, used to route and transform messages between systems. The camel-undertow component provides an HTTP server consumer backed by JBoss Undertow. The vulnerability is a classic CWE-209 (Generation of Error Message Containing Sensitive Information) defect: when a Camel route throws an exception during request processing, the consumer serializes the full Java Throwable stack trace - including all chained causes - as a text/plain HTTP response body. The inconsistency relative to other Camel HTTP components arises because camel-undertow's muteException option defaulted to false rather than true at both the component and endpoint levels. A second, more severe defect exists specifically in RestUndertowHttpBinding, the class that handles Rest DSL route bindings: it was instantiated with a hard-coded false for the mute-exception flag, meaning any explicitly configured muteException=true on a Rest DSL consumer was silently discarded at the binding layer. The fix, merged in GitHub PR apache/camel#23913 and backported to 4.18.x and 4.14.x, aligns the undertow default with the other components and corrects the RestUndertowHttpBinding constructor to honour the configured value.

RemediationAI

Upgrade to a patched release: 4.21.0 for the main line, 4.18.3 for the 4.18.x stream, or 4.14.8 for the 4.14.x LTS stream, as documented at https://camel.apache.org/security/CVE-2026-56139.html. For deployments that cannot upgrade immediately, set muteException=true explicitly on each camel-undertow consumer - either via the URI parameter (e.g., undertow:http://0.0.0.0:8080/api?muteException=true) or globally via the property camel.component.undertow.mute-exception=true. This workaround carries a critical limitation: it does NOT protect Rest DSL consumers on affected versions, because RestUndertowHttpBinding ignores the option until the code fix is applied. Additionally, flipping muteException to true changes observable behaviour for routes that use transferException=true to pass serialized exception objects to callers, since muteException takes precedence - operators relying on transferException semantics in camel-undertow routes must verify behaviour after patching. No network-layer workaround (firewall, WAF rule) is sufficient because any valid processing error, including those triggered by legitimate clients, will leak the stack trace.