Severity:
CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-platform-http) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-platform-http) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-platform-http) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-platform-http) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-platform-http) 4.23.0 unaffected
Description:
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform
HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
The guard that prevents a request header being reflected into the response
compared header names case sensitively, while HTTP header names are case
insensitive. A caller could therefore defeat the suppression simply by varying
the case of the header name. HTTP/2 makes the problem unconditional rather than
optional: the protocol requires header names to be lowercase on the wire, so
the comparison never matched and the suppression was inert for every request on
an HTTP/2 connection. The consequence is that content the caller chose is
echoed back in the response, which is the basis for response-splitting and
cache-poisoning style attacks against whatever sits in front of the Camel
endpoint.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. Request header names are now compared case
insensitively, so the suppression holds regardless of casing and works under
HTTP/2. For deployments that cannot upgrade immediately, strip the headers in
question in front of the Camel endpoint, or remove them from the response in
the route rather than relying on the built-in suppression.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. Request header names are now compared case
insensitively, so the suppression holds regardless of casing and works under
HTTP/2.
Work Arounds:
For deployments that cannot upgrade immediately, strip the headers in question
in front of the Camel endpoint, or remove them from the response in the route
rather than relying on the built-in suppression.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-85254.html
https://issues.apache.org/jira/browse/CAMEL-24453
https://github.com/apache/camel/pull/25831
https://github.com/apache/camel/pull/25940
https://github.com/apache/camel/pull/25942
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-85254
