CVE-2026-49365 Apache Software Foundation CVE debrief

Who should care

Users of Apache Camel Netty HTTP component versions from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0 should be aware of this vulnerability. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

A Generation of Error Message Containing Sensitive Information vulnerability exists in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. By default, this option is set to false, causing the consumer to write the full Throwable stack trace into the HTTP response body as text/plain when a request triggers an exception during route processing. This can disclose sensitive internal information, including credentials, internal host names and IP addresses, filesystem paths, dependency and version details, database and class names, and the application's internal structure.

Defensive priority

Medium priority due to the potential for information disclosure and the relatively low CVSS score of 5.3.

Recommended defensive actions

• Upgrade to version 4.21.0 or later
• If using 4.14.x LTS releases, upgrade to 4.14.8
• If using 4.18.x releases, upgrade to 4.18.3
• Set muteException=true explicitly on the camel-netty-http consumer
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. Apache has released a security advisory for this issue. Evidence is limited, and defenders should verify affected scope and vendor guidance. The vulnerability affects Apache Camel Netty HTTP component versions from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0. Users should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Official resources