CVE-2025-30177
CVE-2025-30177: 4 tracked advisory records across Apache. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
4 advisories- Advisory severityCritical9.8
Critical [CVE-2025-30177 +1] Improper input validation vulnerability in Apache Camel Undertow component
CVE-2026-78329Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed that instance into the UndertowHttpBinding it creates lazily, overwriting the UndertowHeaderFilterStrategy that DefaultUndertowHttpBinding installs in its own constructor. Unless a deployment supplied a custom binding or an explicit headerFilterStrategy, the undertow-specific filtering therefore never executed on endpoint-configured routes: the strategy object was constructed and immediately replaced before it could be consulted. The consequence is that the legacy websocket. Exchange-header prefix…
- Affected products in this advisory
- Apache Camel Undertow
- Source-reported affected versions
- 4.11.0 before 4.14.9
- 4.15.0 before 4.18.4
- 4.19.0 before 4.22.0
- Source-reported fixed versions
- 4.14.9
- 4.18.4
- 4.22.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.22.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4.
- For deployments that cannot upgrade immediately, configure the strategy explicitly rather than relying on the default, for example by binding an UndertowHeaderFilterStrategy in the registry and referencing it on the endpoint as undertow:http://0.0.0.0:8080/foo?headerFilterStrategy=#myStrategy, and additionally strip the dispatch headers at the trust boundary with removeHeaders(“websocket.*”).
1 more entries in the full advisory.
- Advisory severityCritical9.4
Critical [CVE-2025-27636 +3] Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)
CVE-2026-33454Source published Source updated
This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith. As a result, when a Camel application consumes mail through camel-mail (for example via from(\"imap://...\") or from(\"pop3://...\")) the inbound filter check is skipped and Camel-prefixed MIME headers are mapped unfiltered into the Exchange. An attacker who can deliver an email to a mailbox monitored by such a consumer can inject Camel-specific headers that, for some Camel components downstream of the mail consumer (such as camel-bean, camel-exec, or camel-sql), can alter the behaviour of the route.…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- Apache Camel 3.0.0 before 4.14.6
- Apache Camel 4.15.0 before 4.18.1
- Source-reported fixed versions
- 4.14.6
- 4.18.1
- Mitigation guidance
- The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith.
- Users are recommended to upgrade to version 4.19.0, which fixes the issue.
- If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.1.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
- Advisory severityMedium5.3
Medium [CVE-2025-27636 +5] Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers
CVE-2026-63621Source published Source updated
This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri…
- Affected products in this advisory
- Apache Camel Knative
- Source-reported affected versions
- 3.15.0 before 4.14.9
- 4.15.0 before 4.18.4
- 4.19.0 before 4.21.0
- through 4.17.0
1 more entries in the full advisory.
- Source-reported fixed versions
- 4.14.9
- 4.18.4
- 4.21.0
- 4.22.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.22.0, which fixes the issue.
- If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.4.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
- The non-LTS releases 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected but do not receive a maintenance fix; users on those versions should upgrade to 4.18.4 or 4.22.0.
- Advisory severityUnrated
Advisory [CVE-2025-27636 +4] Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering
CVE-2026-47323Source published Source updated
This bulletin covers 5 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- Apache Camel 3.18.0 before 4.14.6
- Apache Camel 4.15.0 before 4.18.2
- Source-reported fixed versions
- 4.14.6
- 4.18.2
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.