CVE-2026-63621: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel

The vulnerability exists in the Apache Camel Knative consumer, which maps inbound CloudEvent attributes onto Camel message headers. In structured content mode (Content-Type application/cloudevents+json), CloudEvent extension fields are copied directly from the JSON body into Exchange headers without applying any header filtering strategy. This allows an unauthenticated attacker to inject Camel-internal headers such as CamelHttpUri, CamelHttpPath, and CamelFileName. When a route forwards messages from a Knative consumer to header-driven components like camel-http or camel-file, these injected headers can override configured values, enabling server-side request forgery (SSRF), path traversal, or message dispatch redirection depending on the route configuration. The vulnerability is an incomplete fix of prior header filtering issues and is related to other CVEs addressing similar patterns in Apache Camel components.

An unauthenticated attacker can exploit this vulnerability to inject internal headers that override legitimate routing or file path values, potentially causing server-side request forgery, path traversal, or message dispatch redirection. The confidentiality impact is low, with no integrity or availability impacts reported.

A fix is available. Users should upgrade to Apache Camel version 4.22.0, which addresses this vulnerability. For users on the 4.18.x LTS stream, upgrading to 4.18.4 is recommended. For those on the 4.14.x LTS stream, upgrading to 4.14.9 is advised. Non-LTS versions 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected but do not receive maintenance fixes; users on these versions should upgrade to 4.18.4 or 4.22.0.