CVE-2026-49365: Apache Camel Netty HTTP Stack Trace Information Disclosure

Technical summary

The camel-netty-http HTTP server consumer implements error handling through the muteException configuration option, which controls whether Throwable stack traces are serialized to the HTTP response body. Due to the backing field being an uninitialized primitive boolean, it defaults to false (Java's default for primitives), whereas sibling HTTP components (camel-http, camel-jetty, camel-servlet, camel-platform-http) default to true. When muteException=false and route processing fails, DefaultNettyHttpBinding writes the complete stack trace as text/plain to the response body instead of returning an empty body. This exposes CWE-209 (Information Exposure Through an Error Message) to any unauthenticated remote client capable of triggering a processing exception.

Business impact

This vulnerability enables reconnaissance attacks by leaking internal system architecture, dependency versions, database names, filesystem paths, and potentially embedded credentials through error messages. An attacker can map the application's structure, identify specific software versions with known weaknesses, and locate valid authentication endpoints or backend services—all without authentication. In regulated environments, the exposure of system details and credentials may also trigger compliance violations (PCI-DSS, SOC 2, HIPAA depending on the data leaked).

Affected systems

Apache Camel versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are affected. The issue is resolved in 4.14.8 (LTS branch), 4.18.3 (release branch), and 4.21.0 (latest). Any deployment running camel-netty-http from these ranges with the default muteException setting is vulnerable.

Exploitability

Exploitability is straightforward: the vulnerability requires no authentication, no user interaction, and no special network conditions beyond basic network access to the endpoint (CVSS AV:N, AC:L, PR:N). An attacker needs only to send a request that triggers a route processing error, such as an invalid parameter, malformed JSON body, or a request targeting a path that throws an exception. The attack can be performed via curl, a browser, or any HTTP client. No exploit code is needed.

Remediation

Immediate mitigation requires either upgrading to a patched version or setting muteException=true. Patched versions are: 4.21.0 (all users), 4.14.8 (LTS users), or 4.18.3 (release stream users). For deployments unable to patch immediately, explicitly set muteException=true either on individual camel-netty-http consumers in route definitions (e.g., netty-http:http://0.0.0.0:8080/api?muteException=true) or globally via the property camel.component.netty-http.configuration.mute-exception=true in application configuration.

Patch guidance

Prioritize upgrades in this order: (1) applications on 4.19.0–4.20.x should upgrade to 4.21.0; (2) applications on 4.18.x should upgrade to 4.18.3; (3) applications on 4.14.x LTS should upgrade to 4.14.8. Verify the specific patched version against the official Apache Camel release notes. If immediate patching is not possible, implement the muteException=true workaround as a temporary measure while planning the upgrade. Test the patched or mitigated deployment to confirm error responses no longer expose stack traces to clients.

Detection guidance

Search your environment for camel-netty-http components in active use. Review route definitions and configuration files for the muteException option—if it is absent or explicitly set to false, the endpoint is vulnerable. Monitor HTTP response logs for patterns indicating stack trace exposure (e.g., 'at java.', 'Exception', or 'Caused by' appearing in response bodies from netty-http endpoints). Implement a simple test request that triggers a known error (e.g., a route that throws an exception or an invalid request) and inspect the HTTP response body for stack trace content.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability should be prioritized because: (1) it requires no authentication or user interaction, making it trivially accessible; (2) stack trace exposure directly leaks information that attackers use to plan further attacks, including credential theft and version-specific exploits; (3) it affects the Netty HTTP component, which is commonly deployed in microservices and API gateways; (4) the fix is straightforward (upgrade or one-line configuration change), making remediation low-friction; and (5) in regulated industries, the exposure may trigger compliance investigations. Organizations with internet-facing Camel instances should treat this as high priority despite the MEDIUM score.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a low confidentiality impact on the affected system itself. However, the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) does not fully capture the downstream risk: stack traces are reconnaissance vectors that enable secondary attacks. From a business risk perspective, information disclosure should be weighted higher when it reveals credentials, system topology, or dependency details. Consider raising this to HIGH in your organization's risk model if your Camel instances are internet-facing or handle sensitive operations.

Frequently asked questions