Review reviewCritical

CVE-2026-33453

Apache Software Foundation Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat Fuse 7

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers (e.g. camel-exec) The camel-coap component maps incoming CoAP request URI query parameters directly into Camel Exchange In message headers without applying any HeaderFilterStrategy. Specifically, CamelCoapResource.handleRequest() iterates over OptionSet.getUriQuery() and calls camelE...

CVSS: 10
EPSS: 6.16%
CISA KEV: Not listed
Published: 2026.04.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability6.16%

Technical severityCVSS 10

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat Fuse 7
Affected versions: >= 4.14.0 <= 4.14.5, >= 4.18.0 < 4.18.1, >= 4.19.0, 4.18.0, 4.19.0
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat Fuse 7 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-915