20 matches found
CVE-2025-27636-Apache-Camel-PoC
Apache Camel CVE-2025–27636 & CVE-2025-29891 PoC CVE-2025–27636 and CVE-2025-29891 are vulnerabilities in Apache Camel that affect versions: 4.10.0-4.10.1, 4.8.0-4.8.4, 3.10.0-3.22.3. Exploitation of these vulnerabilities can enable attackers to execute internal Camel methods. The following is a...
CVE-2025-27636-RCE-in-Apache-Camel
CVE-2025-27636 – Apache Camel RCE Simple Python exploit for the Apache Camel header injection RCE CVE-2025-27636. Usage One-shot command execution ┌──root㉿user-/run/…/user/2024/HTBox/CVE-2025-27636 └─ python3 CVE-2025-27636.py -t http://192.168.159.120 -c "id" Executing: id uid=0root gid=0root...
Exploit for Improper Handling of Case Sensitivity in Apache Camel
CVE-2025-27636 – Apache Camel RCE Simple Python exploit for t...
ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +81 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-jms (>=3.0.0, <=4.14.5)
org.apache.camel:camel-jms MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =1.0, =hyte-mq-4.3.7.hyte-43072, =hyte-mq-4.3.7.hyte-43072, =4.4.11.hyte-26354 and more Source cves: CVE-2025-27636, CVE-2026-40453 Source advisory: GHSA-JG2M-9X48-3GVJ...
Apache Camel has an incomplete fix for CVE-2025-27636
The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...
org.apache.camel.springboot:camel-coap-starter (4.19.0) potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-coap (4.19.0)
org.apache.camel:camel-coap MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-coap and may be impacted: - org.apache.camel.springboot:camel-coap-starter 4.19.0 Source cves: CVE-2025-27636, CVE-2026-40453 Source...
PT-2026-35370
Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.5 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.9 Description A flaw exists in how certain header filter strategies process case-variant internal headers. While t...
org.apache.camel.karaf:camel-undertow (>=4.8.1, <=4.8.5), org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.8.0, <=4.8.5) +3 more potentially affected by CVE-2025-27636 +2 more via org.apache.camel:camel-undertow (>=4.8.0, <=4.8.5)
org.apache.camel:camel-undertow MAVEN version =4.8.0, =4.8.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.5 Source cves: CVE-2025-27636, CVE-2025-29891, CVE-2025-30177 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-9598038...
Moderate: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.3.SP2)
An update for Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available RHBQ 3.15.3.SP2. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...
K000150458: Apache Camel vulnerability CVE-2025-27636
Security Advisory Description Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through = 4.10.1, from 4.8.0 through = 4.8.4, from 3.10.0 through = 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10...
Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 Message Header Injection (CVE-2025-27636)
The version of Apache Camel on the remote host is 3.10.0 prior to 3.22.4, 4.8.x prior to 4.8.5, or 4.10.x prior to 4.10.2. It is, therefore, affected by a message header injection vulnerability: - Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue...
Imperva Protects Against the Apache Camel Vulnerabilities
Introduction: Understanding the Apache Camel Flaw On March 9, 2025, Apache released a security advisory for CVE-2025-27636, a vulnerability in the Apache Camel framework that allows attackers to bypass header filtering via miscased headers. Although rated as moderate, this vulnerability...
ai.wanaku:core-runtime-camel (>=0.0.4, <=0.0.5), ai.wanaku:core-services (>=0.0.2, <=0.0.3) +1706 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-support (>=4.10.0, <=4.10.1)
org.apache.camel:camel-support MAVEN version =4.10.0, =0.0.4, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.5 and more Source cves: CVE-2025-27636, CVE-2025-29891 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-9402847...
Apache Camel Message Header Injection through request parameters
Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.9.0 before 4.10.2, from 4.0.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is...
Detecting and Mitigating the Apache Camel Vulnerabilities
Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerabilities CVE-2025-27636 and CVE-2025-29891...
br.com.senior:crm-http-camel-api (>=0.0.2-alpha, <=0.0.81-alpha), br.com.senior:novasoft-http-camel-api (>=0.0.3-alpha, <=0.0.93-alpha) +2844 more potentially affected by CVE-2025-27636 via org.apache.camel:camel-support (>=3.10.0, <=3.22.3)
org.apache.camel:camel-support MAVEN version =3.10.0, =0.0.2-alpha, =0.0.3-alpha, =0.0.1-alpha, =1.0.0-alpha-1, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =0.0.1-alpha, =18.4.0, =18.4.0, =24.17.0 and more Source cves: CVE-2025-27636 Source advisory:...
CVE-2025-27636
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through = 4.10.1, from 4.8.0 through = 4.8.4, from 3.10.0 through = 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS an...
CVE-2025-27636 Apache Camel: Camel Message Header Injection via Improper Filtering
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through = 4.10.1, from 4.8.0 through = 4.8.4, from 3.10.0 through = 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS an...
CVE-2025-27636 Apache Camel: Camel Message Header Injection via Improper Filtering
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through = 4.10.1, from 4.8.0 through = 4.8.4, from 3.10.0 through = 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS an...