CVE-2026-40453
fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant…
Technology
Apache Camel
CVSS Score
9.9 / 10.0
Affected Versions
>=3.0.0 <4.14.6; >=4.15.0 <4.18.2; 4.19.0
Upstream Fix
See upstream advisory
Published
April 27, 2026
OSSeva Coverage
Fixed upstream
Description
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores hea
Is your Apache Camel deployment affected?
If you're running >=3.0.0 <4.14.6; >=4.15.0 <4.18.2; 4.19.0, you need this patch. Book a discovery call to get covered.