GHSA-695c-x5gc-94gj

Source

https://github.com/advisories/GHSA-695c-x5gc-94gj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-695c-x5gc-94gj/GHSA-695c-x5gc-94gj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-695c-x5gc-94gj

Aliases

CVE-2026-33453

Published

2026-04-27T12:30:38Z

Modified

2026-05-05T16:11:33Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Apache camel-coap allows header injection that can lead to remote code execution

Details

Apache Camel's camel-coap component is vulnerable to header injection because it maps CoAP request URI query parameters directly into Camel message headers without applying a HeaderFilterStrategy. An unauthenticated attacker can send a crafted CoAP request to inject arbitrary Camel internal headers into the exchange.

When a vulnerable route forwards that exchange to a header-sensitive downstream producer, the attacker may be able to control producer behavior. For example, in routes using camel-exec, injected headers can override the configured executable and arguments, which can result in arbitrary command execution with the privileges of the Camel process. Command output may be returned to the attacker in the CoAP response.

This issue affects org.apache.camel:camel-coap from 4.14.0 through 4.14.5 and from 4.18.0 before 4.18.1. It is fixed in 4.14.6, 4.18.1, and 4.19.0.

Database specific

{
    "cwe_ids":  [
        "CWE-915"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-05T14:45:11Z",
    "nvd_published_at":  "2026-04-27T11:16:01Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven / org.apache.camel:camel-coap

Package

Name: org.apache.camel:camel-coap; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-coap

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.14.0

Fixed

4.14.6

Affected versions

4.*

4.14.0

4.14.1

4.14.2

4.14.3

4.14.4

4.14.5

Database specific

last_known_affected_version_range

"<= 4.14.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-695c-x5gc-94gj/GHSA-695c-x5gc-94gj.json"