Improper Handling of Case Sensitivity in Apache Camel - CVE-2026-85254
Published: October 23, 2026
Vulnerability identifier: #VU157305
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85254
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass request-header echo suppression and reflect attacker-controlled content into HTTP responses, potentially enabling response-splitting and cache-poisoning attacks against infrastructure in front of the Camel endpoint.
The vulnerability exists due to improper handling of case sensitivity in the Apache Camel Platform HTTP component when comparing request header names to prevent their reflection into responses. A remote attacker can vary the casing of a request header name to bypass the case-sensitive comparison and cause caller-chosen content to be echoed in the response.
Affected software
Apache Camel
How to mitigate CVE-2026-85254
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1