CVE-2026-85254: Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by varying the case of the header name. HTTP/2 makes the problem unconditional rather than optional: the protocol requires header names to be lowercase on the wire, so the comparison never matched and the suppression was inert for every request on an HTTP/2 connection. The consequence is that content the caller chose is echoed back in the response, which is the basis for response-splitting and cache-poisoning style attacks against whatever sits in front of the Camel endpoint.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Request header names are now compared case insensitively, so the suppression holds regardless of casing and works under HTTP/2. For deployments that cannot upgrade immediately, strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather than relying on the built-in suppression.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.22.1 - Compensating control
For deployments that cannot upgrade immediately, strip the affected request headers in front of the Camel endpoint, or remove them from the response in the route instead of relying on the built-in suppression.
Event History
Frequently Asked Questions
Which deployments are most reliably exposed to header reflection?
Camel Platform HTTP endpoints served over HTTP/2 are affected for every request on an affected version, because HTTP/2 requires lowercase header names and the vulnerable comparison never matches. Under other HTTP versions, a caller can bypass suppression by changing the casing of a request-header name.
What does an attacker need to do to exploit this issue?
The attacker needs to be able to send requests to the Camel endpoint and choose request-header names and values. No authentication or user interaction is indicated by the supplied vector.
What versions should be deployed to remediate the issue?
Upgrade to Apache Camel 4.23.0. For the supported LTS release streams, upgrade 4.18.x to 4.18.5 or 4.22.x to 4.22.1.
How can I assess whether a deployment needs remediation?
A deployment needs remediation if it uses Camel Platform HTTP in Apache Camel versions from 4.0.0 before 4.18.5, or from 4.19.0 before 4.22.1. HTTP/2 exposure makes the vulnerable header-suppression guard ineffective regardless of the caller's header-name casing.