9.9Crítica
Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
Apache Software Foundation Apache Camel JMS; Apache Software Foundation Apache Camel CoAP; Apache Software Foundation Apache Camel Google PubSub; Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to…
2.1%EPSS