Apache Camel up to 4.8.5/4.10.2 Camel-Undertow Message Header injection

Summaryinfo

A vulnerability marked as problematic has been reported in Apache Camel up to 4.8.5/4.10.2. This affects an unknown function of the component Camel-Undertow Message Header Handler. Performing a manipulation results in injection. This vulnerability is reported as CVE-2025-30177. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Apache Camel up to 4.8.5/4.10.2. This affects an unknown code of the component Camel-Undertow Message Header Handler. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on integrity. The summary by CVE is:

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction. This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.

It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-30177 since 03/17/2025. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 265334 (Apache Camel 4.8.0 < 4.8.6 / 4.10.0 < 4.10.3 – Camel-Undertow Bypass/Injection Vulnerability (CVE-2025-30177)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.8.6 or 4.10.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (265334). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Camel

Version

• 4.8.0
• 4.8.1
• 4.8.2
• 4.8.3
• 4.8.4
• 4.8.5
• 4.10.0
• 4.10.1
• 4.10.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion