CVE-2026-78329 — camel-undertow header filter strategy not applied (websocket.* injection)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where UndertowEndpoint defaulted its headerFilterStrategy to the base HttpHeaderFilterStrategy and pushed that instance into the UndertowHttpBinding it creates, overwriting the UndertowHeaderFilterStrategy that DefaultUndertowHttpBinding installs. Unless a deployment supplied a custom binding or an explicit headerFilterStrategy, the undertow-specific filtering never ran — the strategy object was constructed and immediately replaced before it could be consulted.

Camel Quarkus: there is no camel-quarkus-undertow extension (Quarkus uses its own Vert.x HTTP stack), so this component cannot be run on Camel Quarkus — the reproducer is Spring Boot only.

What it demonstrates

The consequence is that the legacy websocket. Exchange-header prefix is not filtered at the undertow transport boundary in either direction. An undertow HTTP consumer therefore maps inbound wire headers of that form (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, …) onto the Exchange, where an undertow WebSocket producer reads them as dispatch directives and can be made to deliver to a peer other than the one the route intended — the same dispatch-hijack class as the atmosphere-websocket CVE-2026-71300.

This reproducer sends an HTTP request carrying websocket.* dispatch headers plus a Camel* control header, and shows what actually reached the Exchange: the websocket.* headers cross the boundary (unfiltered), while Camel* is stripped — proving the base filter (not the undertow one) was in effect.

cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Expected output on an affected build:

What actually reached the Exchange, as echoed by the undertow route:
websocket.connectionKey.list on Exchange = [attacker-connection-key]
websocket.sendToAll on Exchange       = [true]
CamelFoo on Exchange (control)         = []
>>> PROVEN: the undertow endpoint applied the base HttpHeaderFilterStrategy (Camel* filtered) instead of the
>>> UndertowHeaderFilterStrategy, so the legacy websocket.* dispatch headers passed onto the Exchange ...

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-78329.html

The fix

The undertow endpoint no longer overwrites the binding's UndertowHeaderFilterStrategy, which filters the websocket. prefix (added in CAMEL-23588) in both directions — so the dispatch headers are stripped at the transport boundary and an external sender can no longer inject them.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material against systems you do not own or operate.