CVE-2025-29891

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.10.0 through 4.10.2 Apache Camel versions 4.8.0 through 4.8.5 Apache Camel versions 3.10.0 through 3.22.3

Description A bypass and injection issue exists in the default incoming header filter of Apache Camel. The filter performs case-sensitive checks for strings like "Camel", "camel", and "org.apache.camel", but the headers are applied without case sensitivity. This allows a remote attacker to bypass the filter by using mixed-case headers (e.g., CAmelExecCommandExecutable) to execute internal Camel methods or alter the behavior of specific components such as camel-bean and camel-exec.

For applications connected to the internet via HTTP, attackers can inject these headers through HTTP request parameters or the request payload. The following HTTP components are vulnerable by default: camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http. Real-world exploitation has been observed, with over 126,000 attack attempts blocked by security vendors in March alone.

Recommendations Update Apache Camel version 4.10.x LTS to 4.10.2. Update Apache Camel version 4.8.x LTS to 4.8.5. Update Apache Camel version 3.x to 3.22.4.