Improper Neutralization of HTTP Headers for Scripting Syntax in Apache Camel - CVE-2025-27636

Vulnerability details

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when processing HTTP requests, as filters are configured to only block headers starting with "Camel", "camel", or "org.apache.camel". A remote non-authenticated attacker can send a specially crafted HTTP request with altered casing of letters in headers that will be accepted by the application.

Successful exploitation of the vulnerability may allow an attacker to perform cross-site scripting, cache poisoning or session hijacking attacks.

Affected software

How to mitigate CVE-2025-27636

Links to Public Exploits and PoC-codes

• Exploit #11304 - CVE-2025-27636-Apache-Camel-PoC (April 11, 2025)

External References

• http://www.openwall.com/lists/oss-security/2025/03/09/1
• https://issues.apache.org/jira/browse/CAMEL-21828
• https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z

Related Security Bulletins

• Header injection vulnerability in Apache Camel
• Improper Neutralization of HTTP Headers for Scripting Syntax in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.8
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Virtual Account Management