CVE-2026-49365

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.57% · Oct 25, 2026

A flaw was found in the Apache Camel Netty HTTP component. An unauthenticated remote attacker can exploit this vulnerability by sending a malformed request that triggers an exception during route processing. Due to a misconfiguration where `muteException` is set to `false` by default, the system responds with a full Java stack trace. This stack trace can disclose sensitive internal information, such as credentials, internal hostnames, IP addresses, and filesystem paths, which could aid an attacker in planning further attacks. org.apache.camel/camel-netty-http: Apache Camel Netty HTTP: Information disclosure via error messages containing sensitive data This Important information disclosure flaw in the Apache Camel Netty HTTP component allows an unauthenticated remote attacker to obtain sensitive internal system details. By default, the `muteException` option is set to `false` in Red Hat deployments, causing full Java stack traces to be returned in HTTP responses when route processing errors occur. This can expose credentials, internal network configurations, and filesystem paths, significantly aiding an attacker in subsequent exploitation efforts. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.