Skip to content
Fencer Intel
medium 4.8

CVE-2025-29891 json

Apache Camel: Camel Message Header Injection through request parameters

published last yr. modified 4mo ago also EUVD-2025-6254 , GHSA-96v5-c2h5-56hm

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
76.1%
EPSS 76.1% chance of exploitation in 30 days, percentile 99.5%
public exploits
0
none known

Summary

Bypass/Injection vulnerability in Apache Camel.

This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4.

Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.

This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component.

If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers.

The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation.

All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.

This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components.

Patch / fix

  • maven org.apache.camel:camel-support 3.22.4, 4.8.5, 4.10.2
  • Apache Software Foundation Apache Camel 3.22.4, 4.8.5, 4.10.2

Is CVE-2025-29891 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-29891 updated cvss 6.3

camel-http: org.apache.camel: Apache Camel: Camel Message Header Injection through request parameters

  • Red Hat Fuse 7 camel-http, camel-http4, camel-http-base, camel-http-common, camel-http-starter, camel-http4-starter Red Hat Integration Camel K 1 camel-http, camel-http-base, camel-http-common, camel-http-kafka-connector, camel-https-kafka-connector Red Hat Process Automation 7 camel-http-common Red Hat Single Sign-On 7 camel-http-common
    affected: workaround, no fix available “As a workaround, users could use removeHeaders EIP, to filter out anything like ‘cAmel, cAMEL’ etc, or in general everything not starting with ‘Camel’, ‘camel’ or ‘org.apache.camel.’.”
  • Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-cxf-bom, quarkus-camel-bom Red Hat build of Apache Camel for Spring Boot 4 camel-http, camel-http-base, camel-http-common, camel-http-starter
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

76.09% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
maven org.apache.camel:camel-support
>=3.10.0, <3.22.4
>=4.9.0, <4.10.2
>=4.0.0-M1, <4.8.5
3.22.4
4.10.2
4.8.5

Affected products

  • Apache Software Foundation Apache Camel

Classification

Weakness
  • CWE-164 Improper Neutralization of Internal Special Elements

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.