The vulnerability resides in non‑HTTP HeaderFilterStrategy implementations where a case‑sensitive filter is applied to header names, but the Camel Exchange stores headers case‑insensitively. An attacker who can send messages to the broker used by a Camel route can inject headers with case‑variant names that bypass the filter. The headers are then interpreted by components such as camel‑exec or camel‑file, allowing the attacker to trigger execution of arbitrary code on the JVM or write files on the host. The flaw is identified as CWE‑178.

The issue affects Apache Camel assemblies that provide JMS, CoAP, and Google PubSub endpoints. Versions from 3.0.0 up to, but not including, 4.14.6; from 4.15.0 to 4.18.2 (excluding 4.18.2); and from 4.19.0 to 4.20.0 (excluding 4.20.0) are vulnerable. The affected modules are camel‑jms, camel‑sjms, camel‑coap, and camel‑google‑pubsub.

The CVSS score is 9.9, indicating a critical severity. However, the EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting exploitation is unlikely at this time. The attack requires write‑access to messages sent to the broker, which could be provided by an external publisher or a compromised internal message source. If such access is available, the attacker can inject a header such as 'CAmelExecCommandExecutable', bypass the filter, and trigger remote code execution or arbitrary file write through downstream components.