CVEFinder.io

CVE-2025-30177

🔶 medium
🔍 Scan for this CVE
Summary

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" directi

Description

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.

This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.

Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.

Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction.


This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.

CVSS Score
6.5
Medium
EPSS Score
0.6
Exploit Probability
Published Date
2025-04-01
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.8% of all 330,193 vulnerabilities in our database.

#172,448
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Apr 1, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Mark Thorson of AT&T Mark Thorson of AT&T (reporter)
SSVC data provided by CISA
Last Modified 2025-04-15
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE IDs (Weakness Types)
CWE-164

📦 Affected Products 2

Vendor Product Status Affected Versions
apache camel Affected
≥ 4.10.0 < 4.10.3
apache camel Affected
≥ 4.8.0 < 4.8.6

🔗 References 3

https://camel.apache.org/security/CVE-2025-27636.html
Not Applicable
https://camel.apache.org/security/CVE-2025-29891.html
Not Applicable
https://lists.apache.org/thread/dj79zdgw01j337lr9gvy...
Mailing List Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-47323 ⛔ critical 9.8 0.1 Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStra... 2026-05-19
CVE-2026-23552 ⛔ critical 9.1 0.0 Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak Key... 2026-02-23
CVE-2026-25747 ⚠️ high 8.8 0.1 Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSeri... 2026-02-23
CVE-2025-66169 🔶 medium 5.3 0.2 Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 befo... 2026-01-14
CVE-2025-29891 🔶 medium 4.8 0.2 Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 ... 2025-03-12
CVE-2025-27636 🔶 medium 5.6 28.4 Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel:... 2025-03-09
These CVEs affect the same products