Bypass/Injection Vulnerability in Apache Camel by Apache

CVE-2025-27636

Summary

A bypass and injection vulnerability exists in Apache Camel stemming from a flaw in its default header filtering mechanism. This flaw allows attackers to circumvent protective measures by manipulating the casing of header names. As a result, they can inject malicious headers which may invoke arbitrary methods from the Bean registry within the application. The vulnerability affects specific versions of Apache Camel, highlighting the urgent need for users to upgrade to secure versions. Developers are advised to remove headers in Camel routes as a workaround to prevent attacks.

References