CVE-2025-27636: Apache Camel: Camel Message Header Injection via Improper Filtering
First published: Sun Mar 09 2025(Updated: )
Bypass/Injection vulnerability in Apache Camel-Bean component under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is only present in the following situation. The user is using one of the following HTTP Servers via one the of the following Camel components * camel-servlet * camel-jetty * camel-undertow * camel-platform-http * camel-netty-http and in the route, the exchange will be routed to a camel-bean producer. So ONLY camel-bean component is affected. In particular: * The bean invocation (is only affected if you use any of the above together with camel-bean component). * The bean that can be called, has more than 1 method implemented. In these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean. The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.". Mitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Build of Apache Camel | >=4.10.0<=4.10.1>=4.8.0<=4.8.4>=3.10.0<=3.22.3 | |
| maven/org.apache.camel:camel-support | >=4.0.0-M1<4.8.5 | 4.8.5 |
| maven/org.apache.camel:camel-support | >=4.9.0<4.10.2 | 4.10.2 |
| maven/org.apache.camel:camel-support | >=3.10.0<3.22.4 | 3.22.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z
- https://camel.apache.org/security/CVE-2025-27636.html
- https://issues.apache.org/jira/browse/CAMEL-21828
- http://www.openwall.com/lists/oss-security/2025/03/09/1
- https://camel.apache.org/security/CVE-2025-27636.txt.asc
- https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC/blob/main/src/main/java/com/example/camel/VulnerableCamel.java
- https://nvd.nist.gov/vuln/detail/CVE-2025-27636
- https://github.com/apache/camel/commit/23a833eec6131a3cdce6e4b1b40b3ac2035b6adf
- https://github.com/apache/camel/commit/45a6b74f7f8af8fd58f197566938a9534392a624
- https://github.com/apache/camel/blob/camel-4.9.0/core/camel-support/src/main/java/org/apache/camel/support/DefaultHeaderFilterStrategy.java
- https://github.com/advisories/GHSA-2c2h-2855-mf97 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-27636?
CVE-2025-27636 is classified as a critical vulnerability affecting certain versions of Apache Camel.
How do I fix CVE-2025-27636?
To fix CVE-2025-27636, upgrade to Apache Camel version 4.10.2, 4.8.5, or 3.22.4 depending on your installed version.
What versions are affected by CVE-2025-27636?
CVE-2025-27636 affects Apache Camel versions from 4.10.0 to 4.10.1, 4.8.0 to 4.8.4, and 3.10.0 to 3.22.3.
What types of vulnerabilities are related to CVE-2025-27636?
CVE-2025-27636 is related to bypass and injection vulnerabilities impacting the integrity of applications using Apache Camel.
Is there a timeline for patches related to CVE-2025-27636?
Patches for CVE-2025-27636 were released shortly after identification, allowing users to upgrade promptly.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-27636
- agent/guess-ai
- agent/software-canonical-lookup
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/description
- agent/event
- agent/trending
- collector/nvd-cve
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2c2h-2855-mf97
- vendor/apache
- canonical/red hat build of apache camel
- package-manager/maven