The vulnerability arises because the fix for a previous issue (CVE-2025-27636) applied case-insensitive filtering (setLowerCase(true)) only to HTTP HeaderFilterStrategy implementations, but not to five other non-HTTP HeaderFilterStrategy classes including JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy. These non-HTTP strategies use case-sensitive prefix checks ('Camel'/'camel') on headers, while the Camel Exchange stores headers case-insensitively. This mismatch allows an attacker with JMS producer access to inject headers with variant casing that bypass filtering, which are then normalized and interpreted by downstream components such as camel-exec and camel-file. This can lead to remote code execution and arbitrary file writes on affected routes. The vulnerability affects Apache Camel versions 3.0.0 up to but not including 4.14.6, 4.15.0 up to but not including 4.18.2, and 4.19.0 up to but not including 4.20.0. The recommended remediation is to upgrade to Apache Camel 4.20.0 or the appropriate fixed LTS versions 4.14.6 or 4.18.2.

An attacker with JMS producer access to the message broker can exploit this vulnerability to inject specially crafted headers that bypass filtering due to case sensitivity issues. This can result in remote code execution and arbitrary file writes on routes that forward JMS messages to header-driven components such as camel-exec and camel-file. This poses a significant risk to the confidentiality, integrity, and availability of affected systems running vulnerable versions of Apache Camel JMS.

Users should upgrade to Apache Camel version 4.20.0, which includes the fix for this vulnerability. For those using the 4.14.x LTS release stream, upgrading to 4.14.6 is recommended. For users on the 4.18.x release stream, upgrading to 4.18.2 is advised. Patch status is confirmed by the vendor advisory recommending these versions. No alternative mitigations or temporary fixes are indicated.