The vulnerability arises from the camel-undertow consumer defaulting muteException to false, causing the server to return the full Java stack trace when a route processing error occurs. This stack trace is sent as plain text in the HTTP response, revealing internal details such as credential strings, host and IP addresses, file system paths, dependency versions, database and class names, and the application's structural layout. An attacker without authentication can trigger such an error using malformed input, invalid parameters, or other payloads that provoke route‑level failures, resulting in sensitive information disclosure.

Affected versions of Apache Camel Undertow are from 4.0.0 through 4.14.7, from 4.15.0 through 4.18.2, and from 4.19.0 through 4.20.9. The issue impacts all endpoints served by the camel‑undertow consumer, including Rest DSL consumers where the muteException option is ignored.

Exploitation requires only the ability to send a crafted request to an exposed endpoint, with no authentication needed. The CVSS score of 5.3 classifies the vulnerability as moderate severity. The EPSS score is listed as < 1 %, indicating a low probability of widespread exploitation, but the availability of detailed internal information can be valuable for targeted attackers. The vulnerability is not currently listed in CISA’s KEV catalog and no public exploits are known. The Rest DSL endpoint variant remains exposed until the upstream patch replaces the hard‑coded false binding.