CVE-2025-30177: camel — Fix

Description

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction. This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.

Is your site exposed to CVE-2025-30177?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness Type (CWE)

CWE-164 CWE-164

Affected Products

Vendor	Product	Versions
apache	camel	4.8.0 — 4.8.6
apache	camel	4.10.0 — 4.10.3

References

Advisories & Patches

https://lists.apache.org/thread/dj79zdgw01j337lr9gvyy4sv8xfyw8py

Other References

https://camel.apache.org/security/CVE-2025-27636.html https://camel.apache.org/security/CVE-2025-29891.html

Frequently Asked Questions

What is CVE-2025-30177? +

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction. This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-30177? +

CVE-2025-30177 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-30177? +

CVE-2025-30177 affects products from apache, specifically: camel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-30177? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-19072 9.9

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint …

CVE-2025-29891 4.8

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 …

CVE-2026-33453 10.0

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to …

CVE-2026-58150 10.0

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: …

CVE-2026-57834 10.0

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through …

CVE-2026-58162 10.0

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from …

CVE-2025-30177