What is the CVSS score of EUVD-2026-41851?

EUVD-2026-41851 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by EUVD-2026-41851?

Apache Camel's undertow HTTP server component (versions 4.0.0-4.21.0) discloses complete Java stack traces to unauthenticated attackers through exception handling, exposing system architecture,…. A patch is available.

How to fix or mitigate EUVD-2026-41851?

Within 24 hours: Inventory all Apache Camel deployments and identify instances running camel-undertow component in versions 4.0.0-4.21.0. Within 7 days: Apply compensating controls listed below to all affected systems. Within 30 days: Monitor Apache Camel security advisories for patch availability and plan upgrade to patched version once released.

Apache Camel EUVD-2026-41851

| CVE-2026-56139 MEDIUM

Error Message Information Leak (CWE-209)

2026-07-05

GHSA-hjg2-f45w-c566

Apache Java Information Disclosure Camel

5.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable HTTP endpoint requires no authentication (PR:N, AV:N, AC:L), but impact is limited to partial information disclosure (C:L) with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 21:22 NVD

5.3 (MEDIUM)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:20 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Information disclosure in Apache Camel's camel-undertow HTTP server consumer (versions 4.0.0 through 4.21.0) exposes complete Java stack traces to unauthenticated HTTP clients whenever a route processing exception occurs, due to a misconfigured default and a code-level bypass. Unlike every other Camel HTTP server component (camel-http, camel-jetty, camel-servlet, camel-platform-http), all of which default muteException to true, camel-undertow defaulted this option to false - and for Rest DSL consumers the option was silently ignored entirely due to a hard-coded false in RestUndertowHttpBinding, meaning muteException=true gave false confidence without actual protection. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send malformed HTTP request to undertow endpoint

Delivery

Trigger route processing exception

Exploit

Receive text/plain stack trace in HTTP 500 response

Execution

Extract credentials, hostnames, and version strings

Persist

Identify exploitable internal targets

Impact

Execute targeted follow-on attack

Access

Send malformed HTTP request to undertow endpoint

Delivery

Trigger route processing exception

Exploit

Receive text/plain stack trace in HTTP 500 response

Execution

Extract credentials, hostnames, and version strings

Persist

Identify exploitable internal targets

Impact

Execute targeted follow-on attack

Vulnerability AssessmentAI

Exploitation	The vulnerable application must be using the camel-undertow HTTP server consumer specifically - deployments using camel-http, camel-jetty, camel-servlet, or camel-platform-http are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is moderate and principally a reconnaissance enabler rather than a direct data-exfiltration or execution primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a deliberately malformed HTTP POST to a camel-undertow endpoint - for example, supplying an invalid JSON body or an unexpected content-type that causes a deserialization failure in the Camel route. The server responds with HTTP 500 and a text/plain body containing the complete Java stack trace, including embedded database connection strings, internal service hostnames, and the application's dependency versions. …
Remediation	Upgrade to a patched release: 4.21.0 for the main line, 4.18.3 for the 4.18.x stream, or 4.14.8 for the 4.14.x LTS stream, as documented at https://camel.apache.org/security/CVE-2026-56139.html. … Detailed patch versions, workarounds, and compensating controls in full report.