Bypass/Injection Vulnerability in Apache Camel's Undertow Component

CVE-2025-30177

Summary

A bypass and injection vulnerability has been identified in the Camel Undertow component of Apache Camel. The issue arises under specific conditions involving the filtering of message headers. The custom header filter strategy primarily applies to the 'out' direction, neglecting the 'in' direction. This oversight enables an attacker to inject Camel-specific headers that could alter the behavior of certain Camel components, such as camel-bean and camel-exec. It is crucial for users to upgrade to version 4.10.3 for the 4.10.x LTS or to 4.8.6 for the 4.8.x LTS to mitigate this security risk.

References