The vulnerability arises because the fix for a previous issue (CVE-2025-27636) applied case-insensitive filtering only to HTTP HeaderFilterStrategy implementations but not to five non-HTTP HeaderFilterStrategy implementations including JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy. These non-HTTP strategies use case-sensitive filtering on header names starting with 'Camel' or 'camel', while the Camel Exchange stores headers in a case-insensitive map. This mismatch allows an attacker with JMS producer access to inject headers with variant casing that bypass filtering and are later resolved by downstream components using canonical casing, enabling remote code execution and arbitrary file writes. The vulnerability affects Apache Camel JMS in specified version ranges and is fixed in versions 4.14.6, 4.18.2, and 4.20.0.

An attacker with JMS or equivalent producer access to the message broker can exploit this vulnerability to inject specially crafted headers that bypass filtering controls. This can lead to remote code execution and arbitrary file writes on affected Apache Camel routes that forward JMS messages to header-driven components such as camel-exec and camel-file. The CVSS score of 9.9 indicates a critical impact with high confidentiality, integrity, and availability consequences.

Users should upgrade affected Apache Camel JMS versions to 4.20.0 or to the appropriate patched LTS versions: 4.14.6 for the 4.14.x stream and 4.18.2 for the 4.18.x stream. There is no indication that temporary workarounds or other mitigations are available. Patch status is confirmed by the vendor advisory recommending these upgrades.