CVE-2026-40453

🗓️ 27 Apr 2026 08:23:20Reported by apacheType

cve🔗 web.nvd.nist.gov👁 114 Views🌐 WEB

Incomplete fix for CVE-2025-27636 enables case-variant header injection in non-HTTP header filters.

Reporter	Title	Published	Views	Family All 36
ATTACKERKB	CVE-2026-47323	19 May 202612:25	–	attackerkb
ATTACKERKB	CVE-2026-40453	27 Apr 202608:23	–	attackerkb
Chainguard	CVE-2026-40453 vulnerabilities	23 May 202607:17	–	cgr
Circl	CVE-2026-40453	26 Apr 202619:06	–	circl
CNNVD	Apache Camel 安全漏洞	27 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection	27 Apr 202608:23	–	cvelist
GithubExploit	Exploit for Improper Handling of Case Sensitivity in Apache Camel	8 Jul 202618:10	–	githubexploit
EUVD	EUVD-2026-25791	27 Apr 202608:23	–	euvd
Github Security Blog	Apache Camel has an incomplete fix for CVE-2025-27636	27 Apr 202609:34	–	github
HPE Security Bulletins	HPESBNW05060 rev.1 - HPE Telco Network Function Virtualization Orchestrator, Multiple Vulnerabilities	2 Jun 202600:00	–	hpe

NVD

Vulners

Node

apache camelRange3.0.0–4.14.6

apache camelRange4.15.0–4.18.2

apache camelMatch4.19.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-jms",
    "product": "Apache Camel JMS",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.14.6",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.2",
        "status": "affected",
        "version": "4.15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.20.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-coap",
    "product": "Apache Camel CoAP",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.14.6",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.2",
        "status": "affected",
        "version": "4.15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.20.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-google-pubsub",
    "product": "Apache Camel Google PubSub",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.14.6",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.2",
        "status": "affected",
        "version": "4.15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.20.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-40453.html
access	www.access.redhat.com/errata/RHSA-2026:17668
access	www.access.redhat.com/security/cve/CVE-2026-40453
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/errata/RHSA-2026:19835
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40453.json

Parameter	Position	Path	Description	CWE
CAmelExecCommandExecutable	header	exploit/attack	Case-variant Camel header injection bypassing the case-sensitive header filter	CWE-178
CAmelExecCommandArgs	header	exploit/attack	Case-variant Camel header injection bypassing the case-sensitive header filter	CWE-178
CamelExecCommandExecutable	header	exploit/canonical	Canonical Camel header filtered path demonstrating vulnerability bypass when filter is incomplete	CWE-178
CamelExecCommandArgs	header	exploit/canonical	Canonical Camel header filtered path demonstrating vulnerability bypass when filter is incomplete	CWE-178
CamelExecCommandExecutable	header	exploit/normal	Benign path used for normal operation; no RCE in this case but part of the PoC flow	CWE-178
CamelExecCommandArgs	header	exploit/normal	Benign path used for normal operation; no RCE in this case but part of the PoC flow	CWE-178

15 Jul 2026 02:21Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.9

EPSS0.01218

SSVC

CWE-178