CVE-2025-27636

Summary

CVE-2025-27636 is a bypass/injection vulnerability discovered in Apache Camel's default incoming header filter. This issue affects various Camel releases, including versions 4.10.0 through 4.10.1, 4.8.0 through 4.8.4, and 3.10.0 through 3.22.3. An attacker can inject custom headers, such as HTTP headers, to manipulate the behaviors of specific Camel components like camel-bean and camel-jms. This could lead to invoking unintended methods on a bean or sending messages to unintended queues. Components like camel-servlet, camel-jetty, camel-undertow, and others are affected out of the box. To mitigate this vulnerability, developers can remove the headers in their Camel routes using the removeHeaders EIP or by filtering out headers that do not begin with "Camel", "camel", or "org.apache.camel."

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.