Apache Camel’s Netty HTTP component originally compared the request path to its configured context path in a case‑sensitive manner while dispatching requests used a case‑insensitive comparison. This discrepancy allowed an attacker to alter the case of any character within the path so the security constraint would not recognize the path as protected. Consequently the restricted route was reached without authentication or authorization. The flaw does not require credentials or special configuration, merely the ability to send an HTTP request to the Camel consumer.

The vulnerability affects Apache Camel versions prior to 4.18.5 in the 4.18.x series, prior to 4.22.1 in the 4.22.x series, and all versions from 4.0.0 up to those points. Users of these releases are impacted regardless of deployment environment as the flaw is in the core Netty HTTP component.

The CVSS score of 8.2 indicates high severity, and you should treat the vulnerability as a high‑risk issue. EPSS data is not available, so exploitation probability cannot be quantified, but the flaw is actively exploitable with a simple HTTP request. The vulnerability is not listed in CISA’s KEV catalog, though the absence of a listing does not reduce the need for remediation. Attackers may exploit the weakness from any external network accessible to the Camel consumer.