Header injection via incomplete CVE-2025-27636 fix in Apache Camel (CVE-2026-40453)

The fix for CVE-2025-27636 applied case-insensitive header filtering only to HttpHeaderFilterStrategy, leaving five non-HTTP implementations (JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy, SjmsHeaderFilterStrategy, CoAPHeaderFilterStrategy, and GooglePubsubHeaderFilterStrategy) with case-sensitive filtering. An attacker with JMS or equivalent producer access to a broker consumed by a Camel route can inject case-variant Camel internal headers that bypass these filters and are resolved by downstream components using their canonical casing. This enables remote code execution and arbitrary file write on affected routes. Affected versions: - from 3.0.0 before 4.14.6 - from 4.15.0 before 4.18.2 - from 4.19.0 before 4.20.0 We recommend updating to: 4.14.6, 4.18.2, 4.20.0. CVSS 9.9 · our assessment: act_now Reference: https://camel.apache.org/security/CVE-2026-40453.html Details: https://vuln.today/cve/CVE-2026-40453