Read the docs
TI-2025-21279 Aliases CVE-2025-29891GHSA-96v5-c2h5-56hm

Apache Camel: Camel Message Header Injection through request parameters

Priority MEDIUM 61CWE-164Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component. If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers.  The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation. All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box. This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.76087 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Apache Camel (Apache Software Foundation): 4.10.2, 4.8.5, 3.22.4org.apache.camel:camel-support (Maven): 3.22.4, 4.10.2, 4.8.5Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel4.10.0 to before 4.10.2; 4.8.0 to before 4.8.5; 3.10.0 to before 3.22.44.10.2, 4.8.5, 3.22.4Patch availableCNA
—org.apache.camel:camel-support (Maven)3.10.0 to before 3.22.43.22.4Patch availableGHSA-96v5-c2h5-56hm
—org.apache.camel:camel-support (Maven)4.9.0 to before 4.10.24.10.2Patch availableGHSA-96v5-c2h5-56hm
—org.apache.camel:camel-support (Maven)4.0.0-M1 to before 4.8.54.8.5Patch availableGHSA-96v5-c2h5-56hm
  • Apache Camel VendorApache Affected 4.10.0 to before 4.10.2; 4.8.0 to before 4.8.5; 3.10.0 to before 3.22.4 Fixed in 4.10.2, 4.8.5, 3.22.4 Patch available CNA
  • org.apache.camel:camel-support (Maven) Vendor— Affected 3.10.0 to before 3.22.4 Fixed in 3.22.4 Patch available GHSA-96v5-c2h5-56hm
  • org.apache.camel:camel-support (Maven) Vendor— Affected 4.9.0 to before 4.10.2 Fixed in 4.10.2 Patch available GHSA-96v5-c2h5-56hm
  • org.apache.camel:camel-support (Maven) Vendor— Affected 4.0.0-M1 to before 4.8.5 Fixed in 4.8.5 Patch available GHSA-96v5-c2h5-56hm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*3.10.0 to before 3.22.4; 4.8.0 to before 4.8.5; 4.10.0 to before 4.10.2VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 3.10.0 to before 3.22.4; 4.8.0 to before 4.8.5; 4.10.0 to before 4.10.2 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.10.2, 4.8.5, 3.22.4
  • Fix · GHSA-96v5-c2h5-56hm org.apache.camel:camel-support (Maven) Fixed in 3.22.4 Advisory →
  • Fix · GHSA-96v5-c2h5-56hm org.apache.camel:camel-support (Maven) Fixed in 4.10.2 Advisory →
  • Fix · GHSA-96v5-c2h5-56hm org.apache.camel:camel-support (Maven) Fixed in 4.8.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Process Automation 7AffectedNo fix yet: Fix deferred
Red Hat Single Sign-On 7AffectedNo fix yet: Fix deferred
Not affected: 2 products
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29891
  2. 2026-10-03 Alias added: GHSA-96v5-c2h5-56hm

References

Exploit 1

Advisory 2

Other 5

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences