Vulnerability · Published Apr 1, 2025 · Assigned by apache
CVE-2025-30177Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering
Medium 6.5
In plain English
A medium-severity security flaw in Apache Camel from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction. This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.camel:camel-undertow | 4.10.3 | GHSA-vq4p-pchp-6g6v |
| Maven | org.apache.camel:camel-undertow | 4.8.6 | GHSA-vq4p-pchp-6g6v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Camel | 4.10.0 – before 4.10.34.8.0 – before 4.8.6 |
Weakness: CWE-164 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N