REDHAT-BUG-2350682

First published: Fri Mar 07 2025(Updated: )

Affected Component: Apache Camel Framework (specifically versions 3.x through 4.10.1) Vuln Type: Bypass/Injection The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or Attackers can bypass this filter by altering the casing of any letter other than the first one (e.g., "GAme\" or "GAW"). This allows attackers to inject headers like GAmelMeth0dßeanName, which can be exploited to invoke arbitrary methods from the Bean registry@04 and also supports using Simple Expression Language (or OGNL in some cases) as part of the method parameters passed to the bean (see attached examples). There are quite a large number of other "Camel" headers that, if manipulated, could allow an attacker to do some pretty dangerous things (think CamelSqlQuery).

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/references
• agent/last-modified-date
• agent/source
• agent/type
• agent/description
• agent/first-publish-date
• agent/event
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2025-27636
• vendor/apache
• canonical/apache camel