CVE-2025-27636 is a vulnerability in Apache Camel's default incoming header filtering mechanism that allows an attacker to bypass intended header restrictions and inject malicious Camel-specific headers. Apache Camel is an integration framework widely used to route and transform messages across various protocols and systems. The vulnerability affects multiple versions: 3.10.0 through 3.22.3, 4.8.0 through 4.8.4, and 4.10.0 through 4.10.1. The root cause is that the default header filter only blocks headers starting exactly with "Camel", "camel", or "org.apache.camel.", ignoring case variations or other crafted header names. This allows attackers to inject headers that can alter the behavior of components such as camel-bean, camel-jms, and camel-exec. For example, in camel-bean, an attacker can cause the invocation of unintended methods on a bean, potentially leading to unauthorized actions. In camel-jms, malicious headers can redirect messages to different queues on the same broker, violating message routing policies. The vulnerability is exploitable when Camel applications expose HTTP endpoints through components like camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http, which accept HTTP requests from potentially untrusted sources. An attacker can send crafted HTTP headers to inject malicious Camel headers. Exploitation does not require authentication or user interaction but does require network access to the vulnerable HTTP endpoints. The CVSS v3.1 base score is 5.6 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. Mitigation includes upgrading to fixed versions (4.10.2, 4.8.5, or 3.22.4) or applying header filtering in Camel routes using the removeHeaders Enterprise Integration Pattern (EIP) to remove suspicious headers, including those with case variations of "Camel" prefixes. This can be done globally or per route to prevent malicious header injection. The vulnerability affects a broad range of Camel components that use the default header filter strategy, including messaging, HTTP, cloud, and protocol adapters, increasing the attack surface.

The vulnerability allows attackers to manipulate message routing and processing logic within Apache Camel integrations by injecting unauthorized headers. This can lead to unauthorized method invocations on application beans, potentially causing unintended application behavior or data manipulation. In messaging components like camel-jms, attackers can redirect messages to unauthorized queues, potentially causing data leakage, message interception, or denial of service by disrupting message flows. Since many Camel applications are used in enterprise integration scenarios connecting critical systems, this can compromise data integrity and confidentiality. The ability to inject headers remotely via HTTP endpoints increases the risk for internet-facing applications. Although the impact on confidentiality, integrity, and availability is rated as limited, the manipulation of business logic and message routing can have significant operational consequences, including data corruption, unauthorized access to internal systems, and disruption of service workflows. Organizations relying on Apache Camel for critical integrations, especially those exposing HTTP interfaces, face risks of targeted attacks exploiting this vulnerability to bypass security controls and alter application behavior.

1. Upgrade Apache Camel to the fixed versions: 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS, or 3.22.4 for 3.x releases as soon as possible. 2. If immediate upgrade is not feasible, implement explicit header filtering in Camel routes using the removeHeaders EIP to remove all headers that could be malicious, including those with case variations of "Camel" prefixes (e.g., "cAmel", "cAMEL"). 3. Apply global header filtering policies to reject or sanitize incoming headers before processing, especially on HTTP-exposed routes. 4. Restrict network access to Camel HTTP endpoints by using firewalls, API gateways, or reverse proxies to limit exposure to trusted clients only. 5. Monitor logs and message flows for unusual header names or unexpected method invocations on beans to detect exploitation attempts. 6. Conduct code reviews and security testing of Camel routes to ensure no unintended header processing or method exposure exists. 7. Educate developers and operators about this vulnerability and the importance of strict header validation and filtering in integration applications. 8. Consider implementing additional application-layer security controls such as authentication, authorization, and input validation on HTTP endpoints to reduce attack surface.