CVE-2025-29891: Apache Camel: Camel Message Header Injection through request parameters
Apache Software Foundation · Apache Camel
Vendor fix available · Affected: Apache Software Foundation Apache Camel · Exploitation: likely to be exploited (10% or more)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 99% of scored CVEs
DescriptionCVE.org
Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component. If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers. The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation. All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box. This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Apache Software Foundation · Apache Camelfrom 4.10.0 before 4.10.2; from 4.8.0 before 4.8.5; from 3.10.0 before 3.22.4
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Likely to be exploited (10% or more). EPSS gives it a 10% or higher chance of exploitation in the next 30 days.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- March 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-29891 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.