CVE-2025-27636

🗓️ 09 Mar 2025 12:09:58Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 12 Media mentions👁 321 Views🌐 WEB

Apache Camel header injection vulnerability allows bypassing filters; upgrade recommended to 4.10.2.

Reporter	Title	Published	Views	Family All 49
GithubExploit	Exploit for Improper Handling of Case Sensitivity in Apache Camel	10 Sep 202600:00	–	githubexploit
GithubExploit	Exploit for Improper Handling of Case Sensitivity in Apache Camel	9 Mar 202509:42	–	githubexploit
GithubExploit	Exploit for Improper Neutralization of Internal Special Elements in Apache Camel	23 Oct 202509:54	–	githubexploit
Akamai Blog	Detecting and Mitigating the Apache Camel Vulnerabilities	11 Mar 202516:00	–	akamaiblog
attackerkb	CVE-2026-47323	19 May 202612:25	–	attackerkb
attackerkb	CVE-2026-40453	27 Apr 202608:23	–	attackerkb
attackerkb	CVE-2026-33454	27 Apr 202609:42	–	attackerkb
Tenable Nessus	Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 Message Header Injection (CVE-2025-27636)	18 Mar 202500:00	–	nessus
BDU FSTEC	The vulnerability of the Default Header Filtering component in the Apache Camel framework, which is related to insufficient registry checks, allows attackers to influence the integrity, accessibility, and confidentiality of the protected information.	14 Mar 202500:00	–	bdu_fstec
Circl	CVE-2025-27636	9 Mar 202515:26	–	circl

NVD

Vulners

Node

apache camelRange3.10.0–3.22.4

apache camelRange4.8.0–4.8.5

apache camelRange4.10.0–4.10.2

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel",
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.10.2",
        "status": "affected",
        "version": "4.10.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.8.5",
        "status": "affected",
        "version": "4.8.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.22.4",
        "status": "affected",
        "version": "3.10.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z
camel	www.camel.apache.org/security/CVE-2025-27636.html
issues	www.issues.apache.org/jira/browse/CAMEL-21828
github	www.github.com/akamai/CVE-2025-27636-Apache-Camel-PoC/blob/main/src/main/java/com/example/camel/VulnerableCamel.java
openwall	www.openwall.com/lists/oss-security/2025/03/09/1
camel	www.camel.apache.org/security/CVE-2025-27636.txt.asc

Parameter	Position	Path	Description	CWE
CAmelExecCommandExecutable	header	/command-center	CVE-2025-27636 header injection vulnerability in Apache Camel allowing crafting headers to invoke methods or route messages via the /command-center endpoint (header-based attack vector).	CWE-178
CAmelExecCommandArgs	header	/command-center	CVE-2025-27636 header injection vulnerability in Apache Camel allowing crafting headers to invoke methods or route messages via the /command-center endpoint (header-based attack vector).	CWE-178