oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus reproducers and fix verification.
Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-netty-http security
constraint compared the request path against the configured context path using a case-sensitive match, while the
routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons disagree for
any path whose case differs from the configured value: an external caller can alter the case of a character in the
context-path segment so that the security constraint no longer recognises the path as protected, while the request
still dispatches to the same endpoint. The constraint is skipped and the protected route is reached without
satisfying it — no credential, prior access, or special configuration required.
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.5.13 + camel-netty-http 4.22.0 (affected; fixed 4.22.1) |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.29.0 + camel-quarkus-netty-http 3.29.0 (Camel 4.15.0, affected; fixed control 3.40.0 / Camel 4.22.1) |
A netty-http consumer listens on context path /app and is guarded by a SecurityConstraintMapping that protects
/secret (relative to the endpoint) with a rejecting authenticator. Both requests below carry no credentials:
GET /app/secret (configured case) → the constraint recognises it as protected → 401.GET /App/secret (context-path case altered) → the handler's extractTarget strips the context path only on a
case-sensitive startsWith, so the strip is skipped and the constraint does not recognise the path as protected →
the router still dispatches it to the /app endpoint → 200 and the protected body, unauthenticated.On the fixed build both requests return 401.
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
Expected output on the affected build:
Configured case GET /app/secret -> status 401, body:
Altered case GET /App/secret -> status 200, body: PROTECTED-ADMIN-DATA: reached the protected endpoint
>>> PROVEN: /app/secret is correctly rejected (401), but /App/secret bypassed the security constraint ...
| Property | Value |
|---|---|
| Component | camel-netty-http |
| CWE | CWE-178 (Improper Handling of Case Sensitivity) |
| Severity | HIGH |
| Attack vector | A request whose context-path case differs from the configured endpoint path |
| Impact | Security constraint skipped; protected route reached without authentication |
| Affected Versions | From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| Fixed Versions | 4.18.5, 4.22.1, 4.23.0 |
| JIRA | CAMEL-24412 |
| Credit | Claude Security Scan Tool |
Advisory: https://camel.apache.org/security/CVE-2026-80343.html
The security constraint and the context-path handling now compare the path consistently (case-insensitively on the context path), so a case-altered request is recognised as protected exactly like its configured-case form and is subject to the same authentication.
Enforce authorization in the route itself rather than relying solely on the netty-http security constraint, or normalise the request path case before the security check, until you can upgrade.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material against systems you do not own or operate.