The Apache Camel Lucene component reads search queries from exchange headers named QUERY and RETURN_LUCENE_DOCS, which do not use the Camel / camel prefix. Because HttpHeaderFilterStrategy only blocks Camel‑prefixed headers on the HTTP boundary, these legacy names bypass the filter and reach the Lucene producer intact. An attacker can therefore inject arbitrary Lucene search phrases through an HTTP request header, causing the producer to execute the query against the indexed data set. The vulnerability allows an attacker to retrieve documents that should not be visible, such as performing a match‑all query to dump the entire index, or to replace a per‑user filter with a query that returns data outside the intended scope. Additionally, complex regular‑expression queries can consume significant CPU resources, potentially leading to service degradation. No credentials are required when the HTTP consumer is unauthenticated, which means a public endpoint can be abused to silently read sensitive data or exhaust system resources. This vulnerability exemplifies CWE‑20 (Improper Input Validation) and CWE‑639 (Authorization Bypass).

This flaw affects the Apache Camel Lucene component distributed by the Apache Software Foundation. All releases from 4.0.0 up to (but not including) 4.14.8, from 4.15.0 up to (but not including) 4.18.3, and from 4.19.0 up to (but not including) 4.21.0 are impacted. The issue is fixed in 4.14.8 for the 4.14.x LTS stream, 4.18.3 for the 4.18.x stream, and 4.21.0 for newer streams.

The CVSS score of 7.5 reflects high severity, while an EPSS score of less than 1 % indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is feasible via a simple HTTP request that sets the QUERY or RETURN_LUCENE_DOCS headers; the request can be sent from any network to an unauthenticated HTTP consumer, enabling data extraction or service disruption without requiring authentication.