Apache Camel EUVD-2026-104214

Requires a camel-netty-http consumer configured with a NettyHttpSecurityConfiguration/securityConstraint whose inclusions are specific sub-paths rather than a catch-all (e.g. addInclusion('/admin/*')), and in practice matchOnUriPrefix=true so the endpoint context-path is prefix-matched; the attacker then changes the case of a character in the configured context-path segment (e.g. /Foo instead of /foo) so the constraint comparison fails to recognise the path while dispatch still routes it. No credentials, prior access, or special privileges are needed beyond network reachability to the consumer. Limiting factors: consumers without a security constraint, constraints using catch-all inclusions, or path handling fronted by a reverse proxy that normalises case are not exploitable, which bounds real-world exposure to the specific constraint configurations described.

The vendor CVSS of 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated security-constraint bypass, which on paper is a high priority. However, several real-world signals temper this: there is no CISA KEV listing, no EPSS score was provided in the input, and no public exploit code was supplied - only vendor patch PRs with a regression test. More importantly, exploitation is strongly gated by configuration: the flaw only manifests in camel-netty-http consumers that actually deploy a NettyHttpSecurityConfiguration/securityConstraint with specific (non-catch-all) inclusions, typically with matchOnUriPrefix=true. The PR:N rating is justified because the whole point of the bug is bypassing the authentication challenge, so no credentials are needed - this is internally consistent with the description ('No credential, prior access or special configuration is required beyond being able to send a request to the consumer'). Net assessment: a genuinely serious access-control bypass where it applies, but its blast radius is limited to the subset of Camel deployments using netty-http security constraints, so it is a targeted-configuration risk rather than a broad internet-wide mass-exploitation threat. No SSVC decision data (automatable/technical impact) was provided to refine this further.

An attacker able to send HTTP requests to a Camel netty-http consumer that is configured with matchOnUriPrefix=true and a securityConstraint listing specific protected sub-paths (e.g. /admin/*) alters the case of a character in the configured context-path segment - for example requesting /Foo/admin/x instead of /foo/admin/x. The case-sensitive security-constraint strip no longer recognises the path as protected and skips the authentication challenge, while the case-insensitive consumer dispatch still routes the request to the protected endpoint, yielding unauthenticated access. No public proof-of-concept was identified at time of analysis.