CVE-2026-85254: CWE-178 Improper Handling of Case Sensitivity in Apache Software Foundation Apache Camel

Apache Camel Platform HTTP component improperly handled case sensitivity when suppressing request headers from being reflected in responses. The suppression mechanism compared header names case sensitively, while HTTP headers are case insensitive. Under HTTP/2, which mandates lowercase header names, the suppression never matched, making it ineffective. This flaw allows an attacker to inject content that is echoed back in the response, enabling response-splitting and cache-poisoning style attacks against systems in front of the Camel endpoint. The issue affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The fix involves case-insensitive header name comparison, effective even under HTTP/2, implemented in versions 4.18.5, 4.22.1, and 4.23.0.

An attacker can bypass header suppression by varying the case of HTTP header names, causing chosen content to be reflected in HTTP responses. This can lead to response-splitting and cache-poisoning attacks against intermediaries or clients relying on the Camel endpoint. The vulnerability impacts confidentiality and integrity by enabling injection of malicious content into responses. There is no indication of availability impact. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact.

A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to these versions to resolve the vulnerability. For deployments unable to upgrade immediately, it is recommended to strip the relevant headers before they reach the Camel endpoint or remove them from the response within the route configuration rather than relying on the built-in suppression mechanism.