What is the CVSS score of CVE-2026-40453?

CVE-2026-40453 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apache Camel are affected by CVE-2026-40453?

Apache Camel versions with JMS, SJMS, CoAP, and Google Pub/Sub components contain a critical remote code execution and arbitrary file write vulnerability enabling server compromise for adversaries…. A patch is available.

How to fix or mitigate CVE-2026-40453?

Within 24 hours, inventory all Apache Camel deployments and identify systems using vulnerable components (JMS, SJMS, CoAP, Google Pub/Sub); assess business criticality and producer access patterns. Within 7 days, apply the latest Apache Camel security patch for CVE-2026-40453 per vendor advisory; test patched versions in staging before production rollout. Within 30 days, complete patching across all systems, validate message processing workflows, audit producer credentials and access controls, and restrict message broker access to trusted applications with principle-of-least-privilege credentials.

Apache Camel CVE-2026-40453

EUVD-2026-25791 CRITICAL

Improper Handling of Case Sensitivity (CWE-178)

2026-04-27 security@apache.org

GHSA-jg2m-9x48-3gvj

RCE Apache Google Microsoft Canonical Camel

9.9

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Attacker needs broker producer access (PR:L), sends one crafted message remotely (AV:N/AC:L/UI:N); injection crosses into downstream components (S:C) yielding full RCE/file write (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 CRITICAL

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:06 vuln.today

Patch released

Apr 28, 2026 - 19:43 nvd

Patch available

CVSS changed

Apr 27, 2026 - 16:22 NVD

9.9 (None) 9.9 (CRITICAL)

Patch available

Apr 27, 2026 - 10:01 EUVD

EUVD ID Assigned

Apr 27, 2026 - 09:22 euvd

EUVD-2026-25791

CVE Published

Apr 27, 2026 - 09:16 nvd

CRITICAL 9.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19 maven packages depend on org.apache.camel:camel-coap (3 direct, 16 indirect)
19 maven packages depend on org.apache.camel:camel-google-pubsub (3 direct, 16 indirect)
30 maven packages depend on org.apache.camel:camel-jms (12 direct, 18 indirect)
26 maven packages depend on org.apache.camel:camel-sjms (5 direct, 21 indirect)

Ecosystem-wide dependent count for version 3.0.0 and other introduced versions.

DescriptionCVE.org

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

AnalysisAI

Remote code execution and arbitrary file write in Apache Camel affects routes using the JMS, SJMS, CoAP, or Google Pub/Sub components, where an attacker with producer access to a consumed broker can smuggle case-variant Camel internal headers (e.g. 'CAmelExecCommandExecutable') past case-sensitive filtering. The flaw is an incomplete fix for CVE-2025-27636: five non-HTTP HeaderFilterStrategy implementations were never given the setLowerCase(true) hardening, so injected headers are resolved by their canonical casing in downstream components like camel-exec and camel-file. There is no public exploit identified at time of analysis and EPSS is very low (0.06%), but CVSS is 9.9 and SSVC rates technical impact as total.

Technical ContextAI

Apache Camel is a widely used Java enterprise integration framework whose routes move Exchange objects between components (JMS, SJMS, CoAP, Google Pub/Sub, exec, file, etc.). Camel stores message headers in a case-insensitive map, while each component's HeaderFilterStrategy decides which headers cross the boundary between the wire protocol and the internal Exchange. The HTTP strategy was patched for CVE-2025-27636 by calling setLowerCase(true), normalizing header names before applying its startsWith('Camel'/'camel') filter; the JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy (camel-jms), SjmsHeaderFilterStrategy (camel-sjms), CoAPHeaderFilterStrategy (camel-coap), and GooglePubsubHeaderFilterStrategy (camel-google-pubsub) retained purely case-sensitive matching. This is a textbook CWE-178 (Improper Handling of Case Sensitivity): because the filter compares case-sensitively but the consumer looks up case-insensitively, 'CAmelExecCommandExecutable' evades the filter yet still resolves to the trusted 'CamelExecCommandExecutable' control header, letting an attacker override component behavior such as the executable run by camel-exec or the target path used by camel-file.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.20.0, which fixes the issue; users on the 4.14.x LTS stream should move to 4.14.6 and users on the 4.18.x stream to 4.18.2, per https://camel.apache.org/security/CVE-2026-40453.html. Red Hat consumers should apply errata RHSA-2026:17668 and RHSA-2026:19835 (https://access.redhat.com/errata/RHSA-2026:17668). Where immediate upgrade is not possible, apply compensating controls on the affected routes: harden the HeaderFilterStrategy by explicitly enabling lower-case normalization (setLowerCase(true)) or add an explicit out-filter/removeHeaders step that strips 'Camel*'/'camel*' headers case-insensitively before messages reach camel-exec or camel-file; restrict broker producer permissions so untrusted principals cannot publish to the queues/topics these routes consume; and avoid or tightly constrain header-driven use of camel-exec (which runs OS commands) and camel-file (which writes to disk). The trade-offs: aggressive header stripping can break legitimate inter-route Camel headers, so validate route behavior after applying it, and tightening broker ACLs may disrupt existing integrations that rely on shared producer access.