PT-2026-35370 · Apache · Apache Camel

Saroj Khadka · Published 2026-04-27 · Updated 2026-06-04 · CVE-2026-40453

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.5 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.x

Description Certain non-HTTP HeaderFilterStrategy implementations, specifically JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub, use case-sensitive filtering for headers starting with 'Camel' or 'camel'. Since the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS or equivalent producer access to a broker consumed by a Camel route can inject case-variant internal headers. These headers are subsequently resolved by downstream components, such as camel-exec and camel-file, using their canonical casing, potentially leading to remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components.

Recommendations Upgrade versions 3.0.0 through 4.14.5 to 4.14.6. Upgrade versions 4.15.0 through 4.18.1 to 4.18.2. Upgrade versions 4.19.0 through 4.19.x to 4.20.0.

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2026-40453

GHSA-JG2M-9X48-3GVJ

Affected Products

Apache Camel

References · 15

• https://osv.dev/vulnerability/GHSA-jg2m-9x48-3gvj · Vendor Advisory
• https://camel.apache.org/security/CVE-2026-40453.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40453 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/3d2efeed2f6ea757f0254a1d1cdeb9a4f28ca147 · Note
• https://github.com/apache/camel/commit/301bb7401cd480895b94a28a8ad6cf04952d8125 · Note
• https://github.com/apache/camel/pull/22575 · Note
• https://github.com/apache/camel/pull/22576 · Note
• https://github.com/apache/camel/commit/1e331daa4eea0a3f01d951e74cda8faee79495a2 · Note
• https://github.com/apache/camel/pull/22569 · Note
• https://issues.apache.org/jira/browse/CAMEL-23313 · Note
• https://twitter.com/CVEnew/status/2048852233815470101 · Twitter Post
• https://t.me/CVEtracker/51915 · Telegram Post
• https://t.me/cveNotify/165973 · Telegram Post
• https://twitter.com/UpwindMDR/status/2049055661472804989 · Twitter Post