CVE-2025-29891 Apache Camel: Camel Message Header Injection through request parameters

What is CVE-2025-29891?

CVE-2025-29891 is a medium-severity code injection vulnerability in Apache Camel, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Bypass/Injection vulnerability in Apache Camel.

This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4.

Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.

This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component.

If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers. 

The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation.

All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.

This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components.

Weakness: CWE-164

Which versions are affected by CVE-2025-29891?

6 open source packages ship an affected version, including org.apache.camel:camel-support. It affects 1 product.

Products include Apache Camel.

How do I fix CVE-2025-29891?

Upgrade org.apache.camel:camel-support to a fixed version for your release line: 3.22.4, 4.8.5 or 4.10.2.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-29891 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29891 exists.

Other vulnerabilities in Apache Camel

• CVE-2026-33453 Apache camel-coap allows header injection that can lead to remote code execution Critical 10.0
• CVE-2026-40453 Apache Camel has an incomplete fix for CVE-2025-27636 Critical 9.9
• CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod Critical 9.8
• CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects Critical 9.8
• CVE-2026-71300 Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection Critical 9.8

All Apache Camel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-96v5-c2h5-56hm.