Header injection leading to remote code execution in Apache Camel camel-coap (CVE-2026-33453)

The camel-coap component in Apache Camel maps incoming CoAP request URI query parameters directly into Camel Exchange message headers without applying any HeaderFilterStrategy, allowing injection of arbitrary Camel internal headers. An unauthenticated attacker sending a single UDP datagram to the CoAP port can exploit this to achieve remote OS command execution under the privileges of the Camel process when the route forwards requests to header-sensitive producers such as camel-exec. Public POC available. Affected versions: - from 4.14.0 before 4.14.6 - from 4.15.0 before 4.18.1 We recommend updating to: 4.14.6, 4.18.1, 4.19.0. CVSS 10.0 · our assessment: act_now Reference: https://camel.apache.org/security/CVE-2026-33453.html Details: https://vuln.today/cve/CVE-2026-33453