Critical 9.9Published Apr 27, 2026

CVE-2026-40453Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

Updated under an hour ago (Oct 27, 2026, 3:30 PM ET)

Does this affect you?

It affects Apache Software Foundation Apache Camel JMS and 12 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Camel JMS

Exploited in the last 30 days

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

CVSS: 9.9 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-178
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: apache
NVD analysis: Modified
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache Camel JMS apache_software_foundation:apache_camel_jms (from the name)	from 3.0.0 before 4.14.6; from 4.15.0 before 4.18.2; from 4.19.0 before 4.20.0	CNA record
Apache Software Foundation Apache Camel CoAP apache_software_foundation:apache_camel_coap (from the name)	from 3.0.0 before 4.14.6; from 4.15.0 before 4.18.2; from 4.19.0 before 4.20.0	CNA record
Apache Software Foundation Apache Camel Google PubSub apache_software_foundation:apache_camel_google_pubsub (from the name)	from 3.0.0 before 4.14.6; from 4.15.0 before 4.18.2; from 4.19.0 before 4.20.0	CNA record
Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 redhat:apache_camel_quarkus	from google-pubsub not affected	CISA ADP
Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 redhat:apache_camel_spring_boot	from google-pubsub not affected; from http-base not affected; from http-common not affected; from http-starter not affected	CISA ADP
Red Hat OpenShift Serverless redhat:serverless	1	CISA ADP
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 redhat:camel_quarkus	3	CISA ADP
Red Hat Red Hat Fuse 7 redhat:jboss_fuse	7	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 8 redhat:jboss_enterprise_application_platform	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp	Versions not stated	CISA ADP
1–10 of 13

References

References

https://camel.apache.org/security/CVE-2026-40453.html	vendor-advisory
https://access.redhat.com/errata/RHSA-2026:17668
https://access.redhat.com/errata/RHSA-2026:19835
https://access.redhat.com/security/cve/CVE-2026-40453
https://bugzilla.redhat.com/show_bug.cgi?id=2463173
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40453.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.