Review reviewCritical

CVE-2026-40453

Apache Software Foundation Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'...

CVSS: 9.9
EPSS: 1.22%
CISA KEV: Not listed
Published: 2026.04.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability1.22%

Technical severityCVSS 9.9

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub
Affected versions: >= 3.0.0 < 4.14.6, >= 4.15.0 < 4.18.2, >= 4.19.0 < 4.20.0, 4.19.0
Fixed versions: 4.14.6, 4.18.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-178