CVE-2026-49365 — camel-netty-http / camel-undertow muteException Stack-Trace Disclosure

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: the muteException option ships with a default of false in camel-netty-http (and camel-undertow), so on any processing error the full Java stack trace is returned to the HTTP client — leaking internal backend hostnames, database URLs, credential/vault hints, library versions and source locations (CWE-209). jetty/servlet and platform-http already default it to true.

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-49365.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.