CVE-2026-33453

camel-coap Header Injection → RCE Vulnerability Reproducer CVE-2026-33453 This project demonstrates a Camel message header injection vulnerability in Apache Camel's camel-coap component, tracked as CVE-2026-33453. An unauthenticated attacker who can send a single CoAP UDP packet can inject...

Exploit for Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Camel

camel-coap Header Injection → RCE Vulnerability Reproducer CV...

camel-coap Java Framework Code Execution

The vulnerability of the CamelCoapResourceHandleRequest function in the camel-coap Java framework by Apache Camel is related to deficiencies in the mechanism for controlling modifications to dynamically defined object properties. Exploiting this vulnerability could allow an attacker to execute...

Apache camel-coap allows header injection that can lead to remote code execution

Apache Camel's camel-coap component is vulnerable to header injection because it maps CoAP request URI query parameters directly into Camel message headers without applying a HeaderFilterStrategy. An unauthenticated attacker can send a crafted CoAP request to inject arbitrary Camel internal heade...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes throug the CamelCoapResource.handleRequest function. An attacker can execute arbitrary operating system commands by injecting specially crafted CoAP URI quer...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes throug the CamelCoapResource.handleRequest function. An attacker can execute arbitrary operating system commands by injecting specially crafted CoAP URI quer...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to a flaw in the default filtering mechanism HeaderFilterStrategy that only blocks headers starting with specific prefixes. An attacker can execute arbitrary code and write files by injecting...

org.apache.camel.karaf:camel-coap (4.18.1), org.apache.camel.quarkus:camel-quarkus-coap (>=3.29.0, <=3.33.0) +2 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (>=4.15.0, <=4.18.1)

org.apache.camel:camel-coap MAVEN version =4.15.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321638...

org.apache.camel.springboot:camel-coap-starter (4.19.0) potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (4.19.0)

org.apache.camel:camel-coap MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-coap and may be impacted: - org.apache.camel.springboot:camel-coap-starter 4.19.0 Source cves: CVE-2026-40453 Source advisory:...

org.apache.camel.karaf:camel-coap (4.18.1), org.apache.camel.quarkus:camel-quarkus-coap (>=3.29.0, <=3.33.0) +2 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (>=4.15.0, <=4.18.1)

org.apache.camel:camel-coap MAVEN version =4.15.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: OSV:GHSA-JG2M-9X48-3GVJ...

org.apache.camel.springboot:camel-coap-starter (4.19.0) potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-coap (4.19.0)

org.apache.camel:camel-coap MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-coap and may be impacted: - org.apache.camel.springboot:camel-coap-starter 4.19.0 Source cves: CVE-2025-27636, CVE-2026-40453 Source...

org.apache.camel.karaf:camel-coap (4.18.1), org.apache.camel.quarkus:camel-quarkus-coap (>=3.29.0, <=3.33.0) +2 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-coap (>=4.15.0, <=4.18.1)

org.apache.camel:camel-coap MAVEN version =4.15.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2025-27636, CVE-2026-40453 Source advisory: GHSA-JG2M-9X48-3GVJ...

org.apache.camel.springboot:camel-coap-starter (4.19.0) potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (4.19.0)

org.apache.camel:camel-coap MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-coap and may be impacted: - org.apache.camel.springboot:camel-coap-starter 4.19.0 Source cves: CVE-2026-40453 Source advisory:...

org.apache.camel.kafkaconnector:camel-coap-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-coap-tcp-kafka-connector (>=0.1.0, <=0.11.5) +8 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-coap (>=3.0.0, <=4.14.5)

org.apache.camel:camel-coap MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =4.7.0, =1.1.0, =1.1.0, =1.1.0, =2.3.0, =3.0.0, =4.14.5 Source cves: CVE-2025-27636, CVE-2026-40453 Source advisory: GHSA-JG2M-9X48-3GVJ...

CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

org.apache.camel.karaf:camel-coap (4.18.1), org.apache.camel.quarkus:camel-quarkus-coap (>=3.29.0, <=3.33.0) +2 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (>=4.15.0, <=4.18.1)

org.apache.camel:camel-coap MAVEN version =4.15.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: MEND:CVE-2026-40453...

org.apache.camel.springboot:camel-coap-starter (4.19.0) potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (4.19.0)

org.apache.camel:camel-coap MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-coap and may be impacted: - org.apache.camel.springboot:camel-coap-starter 4.19.0 Source cves: CVE-2026-40453 Source advisory:...

org.apache.camel.kafkaconnector:camel-coap-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-coap-tcp-kafka-connector (>=0.1.0, <=0.11.5) +8 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-coap (>=3.0.0, <=4.14.5)

org.apache.camel:camel-coap MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =4.7.0, =1.1.0, =1.1.0, =1.1.0, =2.3.0, =3.0.0, =4.14.5 Source cves: CVE-2026-40453 Source advisory: MEND:CVE-2026-40453...

Apache Camel 安全漏洞

Apache Camel is an open-source integration framework based on the Enterprise Integration Pattern EIP, developed by the Apache Foundation in the United States. This framework provides implementations of Java objects following the EIP pattern, and routing and mediation rules are configured through...

CVE-2026-33453: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to...