CVE-2025-27636

🗓️ 09 Mar 2025 12:09:58Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 12 Media mentions👁 331 Views🌐 WEB

Apache Camel header injection vulnerability allows bypassing filters; upgrade recommended to 4.10.2.

Reporter	Title	Published	Views	Family All 80
GithubExploit	Exploit for Improper Handling of Case Sensitivity in Apache Camel	10 Sep 202600:00	–	githubexploit
GithubExploit	Exploit for Improper Handling of Case Sensitivity in Apache Camel	9 Mar 202509:42	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Internal Special Elements in Apache Camel	23 Oct 202509:54	–	githubexploit
Akamai Blog	Detecting and Mitigating the Apache Camel Vulnerabilities	11 Mar 202516:00	–	akamaiblog
attackerkb	CVE-2026-47323	19 May 202612:25	–	attackerkb
attackerkb	CVE-2026-40453	27 Apr 202608:23	–	attackerkb
attackerkb	CVE-2026-33454	27 Apr 202609:42	–	attackerkb
Tenable Nessus	Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 Message Header Injection (CVE-2025-27636)	18 Mar 202500:00	–	nessus
BDU FSTEC	Apache Camel Default Header Filtering Insufficient Registry Check	14 Mar 202500:00	–	bdu_fstec
Circl	CVE-2025-27636	9 Mar 202515:26	–	circl

NVD

Vulners

Node

apache camelRange3.10.0–3.22.4

apache camelRange4.8.0–4.8.5

apache camelRange4.10.0–4.10.2

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel",
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.10.2",
        "status": "affected",
        "version": "4.10.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.8.5",
        "status": "affected",
        "version": "4.8.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.22.4",
        "status": "affected",
        "version": "3.10.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z
camel	www.camel.apache.org/security/CVE-2025-27636.html
issues	www.issues.apache.org/jira/browse/CAMEL-21828
github	www.github.com/akamai/CVE-2025-27636-Apache-Camel-PoC/blob/main/src/main/java/com/example/camel/VulnerableCamel.java
openwall	www.openwall.com/lists/oss-security/2025/03/09/1
camel	www.camel.apache.org/security/CVE-2025-27636.txt.asc

Parameter	Position	Path	Description	CWE
CAmelExecCommandExecutable	header	/command-center	Apache Camel header injection vulnerability allowing remote code execution via specific headers (e.g., CAmelExecCommandExecutable) when using the camel-exec component.	CWE-178
CAmelExecCommandArgs	header	/command-center	Apache Camel header injection vulnerability allowing remote code execution via specific headers (e.g., CAmelExecCommandExecutable) when using the camel-exec component.	CWE-178