CVE-2025-27636
CVE-2025-27636: 4 tracked advisory records across Apache. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
4 advisories- Advisory severityCritical9.4
Critical [CVE-2025-27636 +3] Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)
CVE-2026-33454Source published Source updated
This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith. As a result, when a Camel application consumes mail through camel-mail (for example via from(\"imap://...\") or from(\"pop3://...\")) the inbound filter check is skipped and Camel-prefixed MIME headers are mapped unfiltered into the Exchange. An attacker who can deliver an email to a mailbox monitored by such a consumer can inject Camel-specific headers that, for some Camel components downstream of the mail consumer (such as camel-bean, camel-exec, or camel-sql), can alter the behaviour of the route.…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- Apache Camel 3.0.0 before 4.14.6
- Apache Camel 4.15.0 before 4.18.1
- Source-reported fixed versions
- 4.14.6
- 4.18.1
- Mitigation guidance
- The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith.
- Users are recommended to upgrade to version 4.19.0, which fixes the issue.
- If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.1.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
- Advisory severityCritical9.9
Critical [CVE-2025-27636 +1] Apache Camel: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as…
CVE-2026-40453Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- 3.0.0 through 4.14.6
- 4.15.0 through 4.18.2
- 4.19.0 through 4.20.0.
- Source-reported fixed versions
- 4.20.0
- 4.14.6
- 4.18.2
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Advisory severityMedium5.3
Medium [CVE-2025-27636 +5] Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers
CVE-2026-63621Source published Source updated
This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri…
- Affected products in this advisory
- Apache Camel Knative
- Source-reported affected versions
- 3.15.0 before 4.14.9
- 4.15.0 before 4.18.4
- 4.19.0 before 4.21.0
- through 4.17.0
1 more entries in the full advisory.
- Source-reported fixed versions
- 4.14.9
- 4.18.4
- 4.21.0
- 4.22.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.22.0, which fixes the issue.
- If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.4.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
- The non-LTS releases 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected but do not receive a maintenance fix; users on those versions should upgrade to 4.18.4 or 4.22.0.
- Advisory severityUnrated
Advisory [CVE-2025-27636 +4] Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering
CVE-2026-47323Source published Source updated
This bulletin covers 5 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- Apache Camel 3.18.0 before 4.14.6
- Apache Camel 4.15.0 before 4.18.2
- Source-reported fixed versions
- 4.14.6
- 4.18.2
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.