--- title: "CVE-2025-27636: Apache Camel: Camel Message Header… | CubePath" description: "Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1…" language: en source: https://cubepath.com/security/cve/CVE-2025-27636 --- # CVE-2025-27636: Apache Camel: Camel Message Header… | CubePath ## Description Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3\. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, to call another method on the bean, than was coded in the application. In the camel-jms component, then a malicious header can be used to send the message to another queue (on the same broker) than was coded in the application. This could also be seen by using the camel-exec component The attacker would need to inject custom headers, such as HTTP protocols. So if you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include malicious HTTP headers in the HTTP requests that are send to the Camel application. All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box. In these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean. In terms of usage of the default header filter strategy the list of components using that is: \* camel-activemq \* camel-activemq6 \* camel-amqp \* camel-aws2-sqs \* camel-azure-servicebus \* camel-cxf-rest \* camel-cxf-soap \* camel-http \* camel-jetty \* camel-jms \* camel-kafka \* camel-knative \* camel-mail \* camel-nats \* camel-netty-http \* camel-platform-http \* camel-rest \* camel-sjms \* camel-spring-rabbitmq \* camel-stomp \* camel-tahu \* camel-undertow \* camel-xmpp The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.". Mitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.". Official description from the CVE record, published by apache. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-27636) ## Key data ### CVSS 3.1 Medium 5.6 Score published by CISA-ADP in the CVE record. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L | Metric | Value | What it means | | ---------------------- | --------- | ----------------------------------------------------------------------------------------- | | Attack vector | Network | The vulnerable component can be reached over a network, possibly from the Internet. | | Attack complexity | High | The attack depends on conditions outside the attacker's control, so it takes preparation. | | Privileges required | None | No account or privileges are needed. | | User interaction | None | No action from any user is needed. | | Scope | Unchanged | The impact stays within the vulnerable component. | | Confidentiality impact | Low | Limited effect on the secrecy of data. | | Integrity impact | Low | Limited effect on the trustworthiness of data. | | Availability impact | Low | Limited effect on availability. | CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at [first.org/cvss](https://www.first.org/cvss/) . ### EPSS Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days. Score 0.97057 (97.1% probability) Percentile 99.9% Scores of Nov 10, 2026 Model v2026.06.15 ### CISA assessment as of Oct 22, 2025 Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA. Exploitation Public proof of concept recorded by CISA Automatable no Technical impact partial ### Weakness (CWE) CWE catalog version 5.0. CWE names: Copyright © 2006-2026, The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CWE license. - [CWE-178](https://cwe.mitre.org/data/definitions/178.html) Improper Handling of Case Sensitivity ## Affected products Products listed in the CVE record, as the CNA published them. - Apache Camel - affected: 4.10.0 up to before 4.10.2 - affected: 4.8.0 up to before 4.8.5 - affected: 3.10.0 up to before 3.22.4 ## References Links listed in the CVE record. They lead to other sites, which CubePath does not control. - [lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z](https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z) vendor-advisory - [issues.apache.org/jira/browse/CAMEL-21828](https://issues.apache.org/jira/browse/CAMEL-21828) issue-tracking - [camel.apache.org/security/CVE-2025-27636.html](https://camel.apache.org/security/CVE-2025-27636.html) vendor-advisory - [openwall.com/lists/oss-security/2025/03/09/1](http://www.openwall.com/lists/oss-security/2025/03/09/1) ## Timeline 1. ID reserved Mar 4, 2025 2. Record published Mar 9, 2025 3. Record last updated Feb 26, 2026 ## Look up another CVE ## About CubePath CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection. [Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 20:03 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)