Ryan Barnett

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.10.0 through 4.10.2 Apache Camel versions 4.8.0 through 4.8.5 Apache Camel versions 3.10.0 through 3.22.3 **Description** A bypass and injection issue exists in the default incoming header filter of Apache Camel. The filter performs case-sensitive checks for strings like "Camel", "camel", and "org.apache.camel", but the headers are applied without case sensitivity. This allows a remote attacker to bypass the filter by using mixed-case headers (e.g., `CAmelExecCommandExecutable`) to execute internal Camel methods or alter the behavior of specific components such as `camel-bean` and `camel-exec`. For applications connected to the internet via HTTP, attackers can inject these headers through HTTP request parameters or the request payload. The following HTTP components are vulnerable by default: `camel-servlet`, `camel-jetty`, `camel-undertow`, `camel-platform-http`, and `camel-netty-http`. Real-world exploitation has been observed, with over 126,000 attack attempts blocked by security vendors in March alone. **Recommendations** Update Apache Camel version 4.10.x LTS to 4.10.2. Update Apache Camel version 4.8.x LTS to 4.8.5. Update Apache Camel version 3.x to 3.22.4.