CVE-2026-33453

🗓️ 27 Apr 2026 09:58:48Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 98 Views🌐 WEB

CVE-2026-33453: CoAP header injection in Apache Camel enables remote code execution via a single packet.

Reporter	Title	Published	Views	Family All 23
GithubExploit	Exploit for CVE-2026-33453	27 Apr 202618:21	–	githubexploit
GithubExploit	Exploit for Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Camel	6 Jul 202612:29	–	githubexploit
ATTACKERKB	CVE-2026-33453	27 Apr 202609:58	–	attackerkb
Tenable Nessus	Apache Camel 4.14.x < 4.14.6 / 4.15.x < 4.18.1 RCE (CVE-2026-33453)	26 Jun 202600:00	–	nessus
BDU FSTEC	The vulnerability of the CamelCoapResourceHandleRequest() function in the camel-coap Java framework by Apache Camel allows a attacker to execute arbitrary code.	29 Apr 202600:00	–	bdu_fstec
Circl	CVE-2026-33453	26 Apr 202619:01	–	circl
CNNVD	Apache Camel 安全漏洞	27 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-33453 Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution	27 Apr 202609:58	–	cvelist
EUVD	EUVD-2026-25816	27 Apr 202609:58	–	euvd
Github Security Blog	Apache camel-coap allows header injection that can lead to remote code execution	27 Apr 202612:30	–	github

NVD

Vulners

Node

apache camelRange4.14.0–4.14.5

apache camelMatch4.18.0

apache camelMatch4.19.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-coap",
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.14.5",
        "status": "affected",
        "version": "4.14.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.1",
        "status": "affected",
        "version": "4.18.0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-33453.html
access	www.access.redhat.com/errata/RHSA-2026:17668
access	www.access.redhat.com/security/cve/CVE-2026-33453
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33453.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
openwall	www.openwall.com/lists/oss-security/2026/04/26/3

Parameter	Position	Path	Description	CWE
CamelExecCommandExecutable	query param	coap://0.0.0.0:5683/run	CoAP URI query params are copied into Camel In headers without filtering, enabling header injection that can override the executable and arguments for header-sensitive producers (e.g., camel-exec) leading to RCE.	CWE-915
CamelExecCommandArgs	query param	coap://0.0.0.0:5683/run	CoAP URI query params are copied into Camel In headers without filtering, enabling header injection that can override the executable and arguments for header-sensitive producers (e.g., camel-exec) leading to RCE.	CWE-915
CamelFileName	query param	coap://0.0.0.0:5683/run	Injection of Camel* file-related header via CoAP query parameter to a header-sensitive producer (e.g., camel-file) enabling arbitrary file write or path traversal.	CWE-915
CamelBeanMethodName	query param	coap://0.0.0.0:5683/run	Injection of Camel* bean method header via CoAP query parameter to a header-sensitive producer (e.g., camel-bean) allowing invocation of an alternate bean method through untrusted input.	CWE-915

15 Jul 2026 02:20Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.110

EPSS0.06157

SSVC

CWE-915