---
title: "CVE-2026-40453: Apache Camel has an incomplete fix for CVE-2025-27636"
url: https://erroneo.us/security/cve/CVE-2026-40453/
description: "CVE-2026-40453 (org.apache.camel:camel-coap (Maven)): The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-04-27
date_modified: 2026-10-05
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-40453"
kev: false
cvss: 9.9
epss: 0.01889
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-40453: Apache Camel has an incomplete fix for CVE-2025-27636

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.9% , percentile 79: FIRST’s model estimates a 1.9% chance of exploitation activity in the next 30 days, higher than 79% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes org.apache.camel:camel-coap (Maven) >= 3.0.0, < 4.14.6, fixed in 4.14.6 ; org.apache.camel:camel-coap (Maven) >= 4.15.0, < 4.18.2, fixed in 4.18.2 ; org.apache.camel:camel-coap (Maven) >= 4.19.0, < 4.20.0, fixed in 4.20.0 ; org.apache.camel:camel-google-pubsub (Maven) >= 3.0.0, < 4.14.6, fixed in 4.14.6 . Check your lockfile, including transitive dependencies.

## What it is

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

## Affected packages

- Maven `org.apache.camel:camel-coap` >= 3.0.0, < 4.14.6 → fixed: 4.14.6
- Maven `org.apache.camel:camel-coap` >= 4.15.0, < 4.18.2 → fixed: 4.18.2
- Maven `org.apache.camel:camel-coap` >= 4.19.0, < 4.20.0 → fixed: 4.20.0
- Maven `org.apache.camel:camel-google-pubsub` >= 3.0.0, < 4.14.6 → fixed: 4.14.6
- Maven `org.apache.camel:camel-google-pubsub` >= 4.15.0, < 4.18.2 → fixed: 4.18.2
- Maven `org.apache.camel:camel-google-pubsub` >= 4.19.0, < 4.20.0 → fixed: 4.20.0
- Maven `org.apache.camel:camel-jms` >= 3.0.0, < 4.14.6 → fixed: 4.14.6
- Maven `org.apache.camel:camel-jms` >= 4.15.0, < 4.18.2 → fixed: 4.18.2
- Maven `org.apache.camel:camel-jms` >= 4.19.0, < 4.20.0 → fixed: 4.20.0
- Maven `org.apache.camel:camel-sjms` >= 3.0.0, < 4.14.6 → fixed: 4.14.6
- Maven `org.apache.camel:camel-sjms` >= 4.15.0, < 4.18.2 → fixed: 4.18.2
- Maven `org.apache.camel:camel-sjms` >= 4.19.0, < 4.20.0 → fixed: 4.20.0

## Affected products (CVE record)

- Apache Software Foundation Apache Camel JMS: 3.0.0 < 4.14.6, 4.15.0 < 4.18.2, 4.19.0 < 4.20.0
- Apache Software Foundation Apache Camel CoAP: 3.0.0 < 4.14.6, 4.15.0 < 4.18.2, 4.19.0 < 4.20.0
- Apache Software Foundation Apache Camel Google PubSub: 3.0.0 < 4.14.6, 4.15.0 < 4.18.2, 4.19.0 < 4.20.0

## Severity

- CISA-ADP CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- redhat-SADP CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.89% probability of exploitation activity in the next 30 days; percentile 79.

## Sources

- [camel.apache.org](https://camel.apache.org/security/CVE-2026-40453.html)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19835)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:17668)
- [GitHub Advisory GHSA-jg2m-9x48-3gvj](https://github.com/advisories/GHSA-jg2m-9x48-3gvj)
- [CVE.org record CVE-2026-40453](https://www.cve.org/CVERecord?id=CVE-2026-40453)
- [NVD entry CVE-2026-40453](https://nvd.nist.gov/vuln/detail/CVE-2026-40453)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-40453)
- [RHBZ#2463173](https://bugzilla.redhat.com/show_bug.cgi?id=2463173)
- [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40453.json)
- [github.com](https://github.com/apache/camel/pull/22569)
- [github.com](https://github.com/apache/camel/pull/22575)
- [github.com](https://github.com/apache/camel/pull/22576)
- [github.com](https://github.com/apache/camel/commit/1e331daa4eea0a3f01d951e74cda8faee79495a2)
- [github.com](https://github.com/apache/camel/commit/301bb7401cd480895b94a28a8ad6cf04952d8125)
- [github.com](https://github.com/apache/camel/commit/3d2efeed2f6ea757f0254a1d1cdeb9a4f28ca147)
- [issues.apache.org](https://issues.apache.org/jira/browse/CAMEL-23313)

---
Source page: https://erroneo.us/security/cve/CVE-2026-40453/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt