CVE-2025-27636

Published Mar 9, 2025

Last updated 25 days ago

CVSS medium 5.6
Apache Camel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-27636 is a bypass/injection vulnerability found in the Apache Camel Bean component. This vulnerability affects Apache Camel versions 4.10.0 through 4.10.1, 4.8.0 through 4.8.4, and 3.10.0 through 3.22.3. The issue arises when specific HTTP servers (camel-servlet, camel-jetty, camel-undertow, camel-platform-http, or camel-netty-http) are used in conjunction with the camel-bean producer, and the targeted bean has multiple methods. Due to a flaw in the header filtering mechanism, an attacker can manipulate header names to invoke unintended methods on the bean. Exploitation of this vulnerability is possible when a bean has multiple methods and is invoked using the camel-bean component together with specific HTTP servers. The vulnerability stems from a bug in the default filtering mechanism, which only blocks headers starting with "Camel," "camel," or "org.apache.camel." By modifying the casing of these prefixes, an attacker can bypass the filter and inject arbitrary headers, leading to the execution of unintended methods within the bean. Users are advised to upgrade to Apache Camel versions 4.10.2, 4.8.5, or 3.22.4, depending on their current version branch. As a mitigation, headers can be removed within Camel routes using methods like the removeHeaders EIP to filter out headers not adhering to the standard prefixes.

Description
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, to call another method on the bean, than was coded in the application. In the camel-jms component, then a malicious header can be used to send the message to another queue (on the same broker) than was coded in the application. This could also be seen by using the camel-exec component The attacker would need to inject custom headers, such as HTTP protocols. So if you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include malicious HTTP headers in the HTTP requests that are send to the Camel application. All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box. In these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean. In terms of usage of the default header filter strategy the list of components using that is: * camel-activemq * camel-activemq6 * camel-amqp * camel-aws2-sqs * camel-azure-servicebus * camel-cxf-rest * camel-cxf-soap * camel-http * camel-jetty * camel-jms * camel-kafka * camel-knative * camel-mail * camel-nats * camel-netty-http * camel-platform-http * camel-rest * camel-sjms * camel-spring-rabbitmq * camel-stomp * camel-tahu * camel-undertow * camel-xmpp The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.".  Mitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
Source
security@apache.org
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Secondary
Base score
5.6
Impact score
3.4
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Severity
MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-178

Social media

Hype score
Not currently trending
  1. Dragon Drop: this week's NEW releases 🐉🚨🔥 🪲 New CVE labs: → CVE-2025-27636_Attack: https://t.co/EG3buL6TEt → Defend CVE-2025-27636: https://t.co/cuuNIy5eiu → CraftStorm_Attack: https://t.co/qxxJugjUqS → Defend CraftStorm: https://t.co/M5KcMl9bya 🧪

    @offsectraining

    18 Jul 2025

    2103 Impressions

    2 Retweets

    14 Likes

    4 Bookmarks

    0 Replies

    0 Quotes

  2. This article delves into security risks posed by unpatched Apache Tomcat and Camel instances. We present an in-depth analysis of CVE-2025-24813 and CVE-2025-27636 and CVE-2025-29891 as well as findings from our telemetry (including exploit payloads). https://t.co/FogfF5t2xU https

    @Unit42_Intel

    15 Jul 2025

    4223 Impressions

    22 Retweets

    62 Likes

    14 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-27636 – #Remote_Code_Execution in #Apache_Camel via Case-Sensitive Header Filtering #Bypass https://t.co/YeqTJkqXVD https://t.co/cFLWeXvxrL

    @omvapt

    13 Jul 2025

    32 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Deep Dive: CVE-2025-27636 (RCE in Apache Camel via Header Filter Bypass) ⚠️ CVSS 5.6 | EPSS 35.5% A case-sensitive header check + exec functionality = remote command execution. Attackers can bypass Camel’s security filters by capitalizing key HTTP headers and execute syst

    @offsectraining

    10 Jul 2025

    4805 Impressions

    7 Retweets

    29 Likes

    13 Bookmarks

    0 Replies

    1 Quote

  5. 【脆弱性分析】Apacheが提供する主要製品に深刻な脆弱性が相次いで発見された。TomcatのCVE-2025-24813と、CamelのCVE-2025-27636、CVE-2025-29891の3つが2025年3月に公開され、いずれもリモートコード実行を可能にする。 Tom

    @nakajimeeee

    5 Jul 2025

    264 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🛡️ RCE flaws in Apache Tomcat (CVE-2025-24813) &amp; Camel (CVE-2025-27636/29891) under active attack. 🚨 Exploits use partial PUT &amp; header case tricks. 🔧 Patch now. Over 125K attempts detected. Read more: https://t.co/tO1iixhgQb #Apache #CVE2025 #CyberSecurity

    @threatsbank

    5 Jul 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. "Apache disclosed critical RCE bugs: CVE-2025-24813 in Tomcat, CVE-2025-27636 &amp; CVE-2025-29891 in Camel. Millions of developers at risk. Patch ASAP."

    @Tudorel92659164

    4 Jul 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Critical vulnerabilities in Apache Tomcat (CVE-2025-24813) &amp; Camel (CVE-2025-27636, CVE-2025-29891) exposed millions to remote code execution. Widespread scans and exploits highlight the urgent need for patches. 🚨 #SecurityAlert #OpenSource #UK https://t.co/Tp9rRTLiPD

    @TweetThreatNews

    3 Jul 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 1/6 1/ 🚨 #Apache bajo ataque: Vulnerabilidades en Tomcat (Partial PUT CVE-2025-24813) y Camel (Header Hijack CVE-2025-27636) revelan riesgos críticos. Descubiertos recientemente, pueden ser explotados para comprometer sistemas. 🌐 Detalles: https://t.co/DlFPoXSyxT

    @x_sentinel99263

    3 Jul 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  10. #Vulnerability #ApacheCamel Apache Camel Vulnerability (CVE-2025-27636) Exposes Applications to RCE, PoC Releases https://t.co/mDViNR0s9U

    @Komodosec

    4 Jun 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. .@Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerability CVE-2025-27636. Learn more. #AkamaiSecurity https://t.co/Ds9z7hVl2e https://t.co/2sn06EPJYF

    @dholland64

    10 Apr 2025

    20 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🚨 Attention all security professionals and IT leaders! Apache Camel vulnerabilities (CVE-2025-27636 and CVE-2025-29891) patched three weeks ago can still pose a significant risk if not addressed properly.

    @fynn_JourX

    2 Apr 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  13. Apache Camel Exploit Attempt by Vulnerability Scan (CVE-2025-27636, CVE-2025-29891) https://t.co/TsVyvm5Mq8 https://t.co/EuAX5I4DRa

    @sans_isc

    31 Mar 2025

    1440 Impressions

    1 Retweet

    7 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  14. .@Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerability CVE-2025-27636. Learn more. #AkamaiSecurity https://t.co/AakyYkdATh https://t.co/3YVZA3IwDl

    @epichol

    27 Mar 2025

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. .@Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerability CVE-2025-27636. Learn more. #AkamaiSecurity https://t.co/UQyz9LM5vs https://t.co/mYb8xSA25V

    @RaghuNain

    18 Mar 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. .@Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerability CVE-2025-27636. Learn more. #AkamaiSecurity https://t.co/I5t80Mlh9W https://t.co/wok8zdTioM

    @ArminBolenius

    13 Mar 2025

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. .@Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerability CVE-2025-27636. Learn more. #AkamaiSecurity https://t.co/RqnoLmFYvt https://t.co/Ljg5dZJsLP

    @AngeloAkamai

    13 Mar 2025

    35 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. Is your Apache Camel app vulnerable? Critical RCE risk disclosed! Apache Camel CVE-2025-27636 exposes RCE via header filtering bypass; patch ASAP. TL;DR: • Apache Camel disclosed CVE-2025-27636 vulnerability. • Incorrect header filtering leads to remote code execution. •… https

    @TweekFawkes

    12 Mar 2025

    88 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  19. Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerability CVE-2025-27636. Learn more. https://t.co/SyiMXWtHz7 https://t.co/Md0rpqY1jL

    @Akamai

    12 Mar 2025

    518 Impressions

    1 Retweet

    4 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. GitHub - akamai/CVE-2025-27636-Apache-Camel-PoC https://t.co/QN8hMeAxWH

    @akaclandestine

    11 Mar 2025

    2374 Impressions

    11 Retweets

    42 Likes

    15 Bookmarks

    0 Replies

    0 Quotes

  21. GitHub - akamai/CVE-2025-27636-Apache-Camel-PoC - https://t.co/b37g3BDuEF

    @piedpiper1616

    10 Mar 2025

    3634 Impressions

    16 Retweets

    39 Likes

    17 Bookmarks

    0 Replies

    0 Quotes

  22. 🚨 CVE-2025-27636 ❓ 🏢 Apache Software Foundation - Apache Camel 🏗️ 4.10.0 🔗 https://t.co/723OXUGK4N 🔗 https://t.co/P4TeBfS7pN #CyberCron #VulnAlert #InfoSec https://t.co/67WeHwPfQB

    @cybercronai

    10 Mar 2025

    81 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  23. New post from https://t.co/uXvPWJy6tj (CVE-2025-27636 | Apache Camel up to 3.22.3/4.8.4/4.10.1 Default Header Filtering injection) has been published on https://t.co/YqWz6yJ60f

    @WolfgangSesin

    9 Mar 2025

    103 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. CVE-2025-27636: Apache Camel: Camel Message Header Injection via Improper Filtering https://t.co/k7sAAYugRT Default filtering mechanism only blocks headers starting with "Camel", "camel", or "org.apache.camel.". Attackers can bypass this filter by altering the casing of letters.

    @oss_security

    9 Mar 2025

    438 Impressions

    0 Retweets

    0 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  25. CVE-2025-27636 Header Injection Vulnerability in Apache Camel Enabling Arbitrary Method Invocation https://t.co/aMgUkgVl8R

    @VulmonFeeds

    9 Mar 2025

    279 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

  26. CVE-2025-27636 Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 through &lt;= 4.10.1, from 4.8.0 through &lt;= 4.8.4, from 3.10.0 through &lt;= 3… https://t.co/lahkvOompC

    @CVEnew

    9 Mar 2025

    1010 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    1 Quote

Configurations