PT-2025-11083 · Apache · Apache Camel

Mark Thorson + 1 · Published 2025-03-12 · Updated 2026-04-27 · CVE-2025-29891

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Apache Camel and Affected Versions Apache Camel versions 3.10.0 through 3.22.4 Apache Camel versions 4.8.0 through 4.8.6 Apache Camel versions 4.10.0 through 4.10.3

Description Apache Camel is susceptible to a bypass/injection flaw stemming from its default incoming header filter. This allows attackers to inject Camel-specific headers, potentially altering the behavior of components like camel-bean or camel-exec. Exploitation is possible when Camel applications are directly connected to the internet via HTTP, enabling attackers to include malicious parameters in HTTP requests that are translated into headers. The vulnerability affects several Camel HTTP components, including camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http. The issue is related to CVE-2025-27636, with the current understanding extending exploitability to HTTP parameters in addition to headers. Exploitation requires the use of vulnerable components within the Camel route. Palo Alto Networks reported blocking approximately 126,000 exploitation attempts in March. The camel-undertow component is particularly vulnerable due to its custom header filter strategy, which only filters the "out" direction, leaving the "in" direction open to injection.

Recommendations Upgrade to version 3.22.4 for 3.x releases. Upgrade to version 4.8.6 for 4.8.x releases. Upgrade to version 4.10.3 for 4.10.x LTS releases.

Exploit

Fix

Weakness Enumeration

CWE-164

Related Identifiers

BDU:2025-03703

CVE-2025-29891

GHSA-96V5-C2H5-56HM

GHSA-VQ4P-PCHP-6G6V

Affected Products

Apache Camel

References · 60

• 🔥 https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC · Exploit
• https://camel.apache.org/security/CVE-2025-29891.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30177 · Security Note
• https://osv.dev/vulnerability/GHSA-vq4p-pchp-6g6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29891 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03703 · Security Note
• https://osv.dev/vulnerability/GHSA-96v5-c2h5-56hm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29891 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/9fd8fc30dbd98511a1faa0cbcf39ef5aeec88a64 · Note
• https://github.com/apache/camel/commit/45a6b74f7f8af8fd58f197566938a9534392a624 · Note
• https://github.com/apache/camel/commit/23a833eec6131a3cdce6e4b1b40b3ac2035b6adf · Note
• https://twitter.com/nanovms/status/1907121248016232681 · Twitter Post
• https://twitter.com/ksg93rd/status/1900547167514681723 · Twitter Post
• https://isc.sans.edu/diary/rss/31814 · Note