Vulnerability in Apache Camel
CVE-2025-30177
Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction. This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
EPSS: 0.012 (67.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Apache Camel
- Apache Software Foundation Camel — versions 4.10.0, 4.8.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (related, Not Applicable)
- security@apache.org (related, Not Applicable)
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-30177?
- CVE-2025-30177 is a medium-severity vulnerability in Apache Camel, classified under CWE-164. CVSS score: 6.5/10. Published 2025-04-01.
- How severe is CVE-2025-30177?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-30177 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.