CVE-2025-29891: Apache Camel header filter bypass allows header injection via HTTP parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication in default HTTP components, has a public exploit reference, and carries a very high EPSS score, though impact is limited by the CVSS rating and route-specific conditions.

What it is

Apache Camel's default incoming header filter fails to block Camel-specific headers, allowing an attacker to inject headers that alter behavior of components such as camel-bean and camel-exec. The flaw affects Camel 4.10.0 before 4.10.2, 4.8.0 before 4.8.5, and 3.10.0 before 3.22.4, and is now known to be reachable through HTTP request parameters as well as headers. It matters because internet-facing Camel HTTP applications are vulnerable out of the box when routes use the affected components.

Impact

An attacker can inject Camel headers that change how vulnerable components process a message, potentially influencing bean invocation or command execution paths. The CVSS vector rates only low integrity and availability impact, so the practical gain depends on the route and component in use.

Attack surface

Reached over the network through HTTP requests to Camel HTTP components such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http. No authentication or user interaction is required per the CVSS vector, but exploitation only works if the Camel route uses a vulnerable component.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.73445 (99.44th percentile), and a public proof-of-concept reference is tagged Exploit. The vendor advisory confirms the issue and the related CVE-2025-27636.

What to do

• Upgrade to Apache Camel 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS, or 3.22.4 for 3.x releases.
• If immediate upgrade is not possible, restrict or filter incoming HTTP parameters and headers before they reach Camel routes.
• Review Camel routes for use of camel-bean, camel-exec, and other components that consume Camel-specific headers.
• Limit internet exposure of Camel HTTP endpoints until patched.

Detection

• Inspect HTTP requests to Camel endpoints for parameters or headers beginning with 'Camel' or 'camel'.
• Monitor application logs for unexpected bean invocation or exec component activity following HTTP requests.
• Alert on anomalous header names in requests handled by camel-servlet, camel-jetty, camel-undertow, camel-platform-http, or camel-netty-http.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.