TI-2026-76356 Aliases CVE-2026-85254 GHSA-9jfp-c25q-rf5q

Apache Camel Platform HTTP reflects suppressed request headers

LOW 36CWE-178Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 is affected in the Platform HTTP component. The check that blocks request headers from being reflected into responses is case sensitive, but HTTP header names are not (CWE-178). A remote attacker without privileges can vary the case of a header name to bypass the suppression, and HTTP/2 requests always bypass it. Echoed content can enable response splitting and cache poisoning against systems in front of the endpoint.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by varying the case of the header name. HTTP/2 makes the problem unconditional rather than optional: the protocol requires header names to be lowercase on the wire, so the comparison never matched and the suppression was inert for every request on an HTTP/2 connection. The consequence is that content the caller chose is echoed back in the response, which is the basis for response-splitting and cache-poisoning style attacks against whatever sits in front of the Camel endpoint. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Request header names are now compared case insensitively, so the suppression holds regardless of casing and works under HTTP/2. For deployments that cannot upgrade immediately, strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather than relying on the built-in suppression.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00678 52nd percentileScored 2026-11-07

Fix Partial Apache Camel (Apache Software Foundation): 4.18.5, 4.22.1, 4.23.0Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Camel	4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1	4.18.5, 4.22.1, 4.23.0	Patch available	CNA

Apache Camel VendorApache Affected 4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1 Fixed in 4.18.5, 4.22.1, 4.23.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:camel::::::::	4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1	Vulnerable	Apache

cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1 Vulnerable ·Apache

Remediation

Upgrade Apache Camel to 4.18.5 on the 4.18.x LTS stream, 4.22.1 on the 4.22.x LTS stream, or 4.23.0. Red Hat plans no fix for Red Hat Fuse 7 and lists no available fix for OpenShift Serverless, Red Hat build of Apache Camel 4 for Quarkus 3 and Red Hat build of Apache Camel for Spring Boot 4. Until upgrading, strip the affected headers in front of the Camel endpoint or remove them from the response in the route.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.18.5, 4.22.1, 4.23.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-19
Apache Camel 4.18.5, 4.22.1
39 records Highest priority Priority HIGH 6 HIGH, 9 MEDIUM, 24 LOW
Other records, highest priority first
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcastPriority HIGH 82
- TI-2026-76339 Path traversal in Apache Camel azure-files componentPriority HIGH 74
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directoryPriority HIGH 74
Show all 39 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Serverless	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-19 Threatist record created from CVE-2026-85254
2026-10-19 Alias added: GHSA-9jfp-c25q-rf5q
2026-10-19 CISA SSVC decision points changed
2026-10-19 Priority changed: MEDIUM → LOW
2026-11-04 EPSS moved to the 50th–90th percentile
2026-11-04 Affected versions changed · Red Hat
2026-11-04 CVSS score added · Red Hat

References

Patch 4

Advisory 1

CAMEL-24453

TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8

See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences