CVE-2025-30177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30177
Aliases
Published
2025-04-01T11:56:30.484Z
Modified
2026-07-15T01:49:19.150083314Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering
Details

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.

This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.

Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.

Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction.

This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30177.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.10.0"
                },
                {
                    "fixed": "4.10.3"
                },
                {
                    "introduced": "4.8.0"
                },
                {
                    "fixed": "4.8.6"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "4.10.0"
                },
                {
                    "fixed": "4.10.3"
                },
                {
                    "introduced": "4.8.0"
                },
                {
                    "fixed": "4.8.6"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-164"
    ]
}
References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type
GIT
Repo
https://github.com/apache/camel
Events
Introduced
071f95d5647b8597ca1c4ae6201b3442f87d120d
Fixed
f8b3a16077cab2e85f58d2e47b5d3355d27c1f8a
Introduced
6f00e4749db83b2f8b797b79e7cf9c4ace314ba9
Fixed
4936ada737a7f905eb63438d1ef22e88a7d2e81f
Database specific 
{
    "cpe": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "4.8.0"
        },
        {
            "fixed": "4.8.6"
        },
        {
            "introduced": "4.10.0"
        },
        {
            "fixed": "4.10.3"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30177.json"