CVE-2026-40453

Critical [CVE-2025-27636 +1] Apache Camel: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as…

CVE-2026-40453Source published Apr 27, 2026Source updated Jun 27, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant…

Affected products in this advisory

• Apache Camel

Source-reported affected versions

• 3.0.0 through 4.14.6
• 4.15.0 through 4.18.2
• 4.19.0 through 4.20.0.

Source-reported fixed versions

• 4.20.0
• 4.14.6
• 4.18.2

Mitigation guidance

No mitigation guidance extracted; consult the source.

Medium [CVE-2025-27636 +5] Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers

CVE-2026-63621Source published Aug 24, 2026Source updated Aug 27, 2026

This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri…

Affected products in this advisory

• Apache Camel Knative

Source-reported affected versions

• 3.15.0 before 4.14.9
• 4.15.0 before 4.18.4
• 4.19.0 before 4.21.0
• through 4.17.0

1 more entries in the full advisory.

Source-reported fixed versions

• 4.14.9
• 4.18.4
• 4.21.0
• 4.22.0

Mitigation guidance

• Users are recommended to upgrade to version 4.22.0, which fixes the issue.
• If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.4.
• If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
• The non-LTS releases 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected but do not receive a maintenance fix; users on those versions should upgrade to 4.18.4 or 4.22.0.

Advisory [CVE-2025-27636 +4] Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

CVE-2026-47323Source published May 19, 2026Source updated Jul 15, 2026

This bulletin covers 5 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code…

Affected products in this advisory

• Apache Camel

Source-reported affected versions

• Apache Camel 3.18.0 before 4.14.6
• Apache Camel 4.15.0 before 4.18.2

Source-reported fixed versions

• 4.14.6
• 4.18.2

Mitigation guidance

No mitigation guidance extracted; consult the source.

Critical [CVE-2026-40453] Remote Code Execution and Arbitrary File Write via case-variant header injection

CVE-2026-40453Source published Apr 27, 2026

Remote Code Execution and Arbitrary File Write via case-variant header injection. Red Hat rates this critical (CVSS 9.9). Weakness: CWE-178. Affected package(s): camel-http-starter, camel-google-pubsub, camel-http-common, camel-jms, camel-http-base, camel-http. Resolved in Red Hat advisory RHSA-2026:19835 — update the affected packages (`sudo dnf update`).

Affected products in this advisory

• Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
• Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
• Red Hat build of Apache Camel 4 for Quarkus 3

Source-reported affected versions

• camel-http-starter
• camel-google-pubsub
• camel-http-common
• camel-jms

2 more entries in the full advisory.

Source-reported fixed versions

• RHSA-2026:19835

Mitigation guidance

• Update the affected package(s) to the fixed version shipped in RHSA-2026:19835 (`sudo dnf update` / `yum update`).