CVE-2026-40453General(apache / camel)

🚨 Critical - Multiple RCE vulnerabilities in Apache Camel components (CVE-2026-33453 / CVE-2026-33454 / CVE-2026-40453) CVE-2026-33453 - camel-coap allows header injection via URI query params, enabling unauthenticated RCE when routed to header-sensitive components (e.g. camel-exec). 👉 Affected: >= 4.14.0, <= 4.14.5 | >= 4.18.0, < 4.18.1 | 4.19.0 | Upgrade: 4.18.1 / 4.19.0 CVE-2026-33454 - camel-mail missing inbound header filtering allows attacker-controlled email headers to manipulate routes and trigger RCE in downstream components. 👉 Affected: >= 3.0.0, < 4.14.6 | >= 4.15.0, < 4.18.1 | Upgrade: 4.14.6 / 4.18.1 / 4.19.0 CVE-2026-40453 - Multiple components lack case-insensitive header filtering, enabling injection of Camel internal headers and leading to RCE/file write via downstream processors. 👉 Affected: >= 3.0.0, < 4.14.6 | >= 4.15.0, < 4.18.2 | >= 4.19.0, < 4.20.0 | Upgrade: 4.14.6 / 4.18.2 / 4.20.0

🚨 CVE-2026-40453: A PoC has been released for an Apache Camel JMS vulnerability that could lead to remote code execution (RCE) through case-variant header injection. Upgrade to a patched release. 🔗 https://github.com/oscerd/CVE-2026-40453 #CyberSecurity #CVE #Apache #Camel #RCE #ThreatWire

A PoC/exploit has been discovered for vulnerability CVE-2026-40453 PT ID: PT-2026-35370 Vendor: Apache Software Foundation Product: Apache Camel JMS Description: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-35370 • https://github.com/oscerd/CVE-2026-40453 #dbugs_vuln

CVE-2026-40453 The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered ou… https://www.cve.org/CVERecord?id=CVE-2026-40453

CVE-2026-40453 CVE-2026-40453 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40453