Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for…
Priority MEDIUM 47CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02104 81st percentileScored 2026-11-07
Fix Partial Apache Camel JMS (Apache Software Foundation): 4.14.6, 4.18.2, 4.20.0Apache Camel CoAP (Apache Software Foundation): 4.14.6, 4.18.2, 4.20.0+5 more productsRed Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel JMS | 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 | 4.14.6, 4.18.2, 4.20.0 | Patch available | CNA |
| Apache | Apache Camel CoAP | 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 | 4.14.6, 4.18.2, 4.20.0 | Patch available | CNA |
| Apache | Apache Camel Google PubSub | 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 | 4.14.6, 4.18.2, 4.20.0 | Patch available | CNA |
| — | org.apache.camel:camel-coap (Maven) | 3.0.0 to before 4.14.6 | 4.14.6 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-coap (Maven) | 4.15.0 to before 4.18.2 | 4.18.2 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-coap (Maven) | 4.19.0 to before 4.20.0 | 4.20.0 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-google-pubsub (Maven) | 3.0.0 to before 4.14.6 | 4.14.6 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-google-pubsub (Maven) | 4.15.0 to before 4.18.2 | 4.18.2 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-google-pubsub (Maven) | 4.19.0 to before 4.20.0 | 4.20.0 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-jms (Maven) | 3.0.0 to before 4.14.6 | 4.14.6 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-jms (Maven) | 4.15.0 to before 4.18.2 | 4.18.2 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-jms (Maven) | 4.19.0 to before 4.20.0 | 4.20.0 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-sjms (Maven) | 3.0.0 to before 4.14.6 | 4.14.6 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-sjms (Maven) | 4.15.0 to before 4.18.2 | 4.18.2 | Patch available | GHSA-jg2m-9x48-3gvj |
| — | org.apache.camel:camel-sjms (Maven) | 4.19.0 to before 4.20.0 | 4.20.0 | Patch available | GHSA-jg2m-9x48-3gvj |
- Apache Camel JMS VendorApache Affected 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 Fixed in 4.14.6, 4.18.2, 4.20.0 Patch available CNA
- Apache Camel CoAP VendorApache Affected 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 Fixed in 4.14.6, 4.18.2, 4.20.0 Patch available CNA
- Apache Camel Google PubSub VendorApache Affected 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 Fixed in 4.14.6, 4.18.2, 4.20.0 Patch available CNA
- org.apache.camel:camel-coap (Maven) Vendor— Affected 3.0.0 to before 4.14.6 Fixed in 4.14.6 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-coap (Maven) Vendor— Affected 4.15.0 to before 4.18.2 Fixed in 4.18.2 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-coap (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-google-pubsub (Maven) Vendor— Affected 3.0.0 to before 4.14.6 Fixed in 4.14.6 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-google-pubsub (Maven) Vendor— Affected 4.15.0 to before 4.18.2 Fixed in 4.18.2 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-google-pubsub (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-jms (Maven) Vendor— Affected 3.0.0 to before 4.14.6 Fixed in 4.14.6 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-jms (Maven) Vendor— Affected 4.15.0 to before 4.18.2 Fixed in 4.18.2 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-jms (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-sjms (Maven) Vendor— Affected 3.0.0 to before 4.14.6 Fixed in 4.14.6 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-sjms (Maven) Vendor— Affected 4.15.0 to before 4.18.2 Fixed in 4.18.2 Patch available GHSA-jg2m-9x48-3gvj
- org.apache.camel:camel-sjms (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-jg2m-9x48-3gvj
Remediation
- Fix · CNA Apache Camel JMS (Apache Software Foundation) Fixed in 4.14.6, 4.18.2, 4.20.0
- Fix · CNA Apache Camel CoAP (Apache Software Foundation) Fixed in 4.14.6, 4.18.2, 4.20.0
- Fix · CNA Apache Camel Google PubSub (Apache Software Foundation) Fixed in 4.14.6, 4.18.2, 4.20.0
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-coap (Maven) Fixed in 4.14.6 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-coap (Maven) Fixed in 4.18.2 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-coap (Maven) Fixed in 4.20.0 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-google-pubsub (Maven) Fixed in 4.14.6 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-google-pubsub (Maven) Fixed in 4.18.2 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-google-pubsub (Maven) Fixed in 4.20.0 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-jms (Maven) Fixed in 4.14.6 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-jms (Maven) Fixed in 4.18.2 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-jms (Maven) Fixed in 4.20.0 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-sjms (Maven) Fixed in 4.14.6 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-sjms (Maven) Fixed in 4.18.2 Advisory →
- Fix · GHSA-jg2m-9x48-3gvj org.apache.camel:camel-sjms (Maven) Fixed in 4.20.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:19835 Released 2026-05-20 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP2)
- Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
- RHSA-2026:17668 Released 2026-05-14 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.18.1 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | — |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 | Fixed | RHSA-2026:19835 |
| Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 | Fixed | RHSA-2026:17668 |
Not affected: 6 products
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel 4 for Quarkus 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40453
- 2026-10-03 Alias added: GHSA-jg2m-9x48-3gvj
- 2026-10-05 4 new references · GHSA-jg2m-9x48-3gvj
- 2026-10-09 Fix available: RHSA-2026:19835 · Red Hat
- 2026-10-10 Fix available: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · Red Hat
References
Advisory 2
Other 12
- https://github.com/apache/camel/pull/22569
- https://github.com/apache/camel/pull/22575
- https://github.com/apache/camel/pull/22576
- https://github.com/apache/camel/commit/1e331daa4eea0a3f01d951e74cda8faee79495a2
- https://github.com/apache/camel/commit/301bb7401cd480895b94a28a8ad6cf04952d8125
- https://github.com/apache/camel/commit/3d2efeed2f6ea757f0254a1d1cdeb9a4f28ca147
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:19835
- https://access.redhat.com/security/cve/CVE-2026-40453
- https://bugzilla.redhat.com/show_bug.cgi?id=2463173
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-23313
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-40453 · CVE Program
- CVE-2026-40453 · NVD
- FIRST EPSS
- GHSA-jg2m-9x48-3gvj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-40453 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences