The vulnerability CVE-2026-40453 in Apache Camel JMS stems from inconsistent application of case-insensitive filtering in header filter strategies. While the HTTP HeaderFilterStrategy was fixed in a prior CVE by enforcing lowercase filtering, five other strategies including JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy did not receive this fix. Because Camel stores headers in a case-insensitive map but filters headers using case-sensitive checks, an attacker with JMS producer access can inject headers with variant casing that bypass filtering. These injected headers are then interpreted by downstream components such as camel-exec and camel-file, potentially leading to remote code execution and arbitrary file writes. The vulnerability affects Apache Camel versions 3.0.0 up to but not including 4.14.6, 4.15.0 up to but not including 4.18.2, and 4.19.0 up to but not including 4.20.0. The vendor recommends upgrading to fixed versions 4.14.6, 4.18.2, or 4.20.0 depending on the release stream. Red Hat advisories confirm the critical severity and provide updates for their builds.

Successful exploitation allows an attacker with JMS producer access to inject specially crafted headers with case variants that bypass filtering controls. This can lead to remote code execution and arbitrary file writes on routes that forward JMS messages to header-driven components such as camel-exec and camel-file. The vulnerability compromises confidentiality, integrity, and availability of affected systems, rated with a CVSS 3.1 score of 9.9 (critical).

A fix is available. Users should upgrade to Apache Camel version 4.20.0 or later. For users on the 4.14.x LTS stream, upgrade to 4.14.6 is recommended. For those on the 4.18.x stream, upgrade to 4.18.2 is advised. Red Hat provides updated builds addressing this vulnerability. Applying these updates will remediate the issue. No alternative mitigations or workarounds are indicated in the vendor advisory.