Saroj Khadka

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 3.0.0 through 4.14.5 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.9 **Description** A flaw exists in how certain header filter strategies process case-variant internal headers. While the Camel Exchange stores headers in a case-insensitive map, several non-HTTP HeaderFilterStrategy implementations—specifically JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub—use case-sensitive filtering via the `startsWith()` function. An attacker with Java Message Service (JMS) or equivalent producer access to a broker consumed by a Camel route can inject case-variant internal headers (e.g., 'CAmelExecCommandExecutable'). These are subsequently resolved by downstream components like camel-exec and camel-file using canonical casing, potentially leading to remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components. **Recommendations** Upgrade to version 4.14.6 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x releases stream. Upgrade to version 4.20.0 for all other affected versions.