This vulnerability, identified as CWE‑20 (Improper Input Validation) and CWE‑918 (Server‑Side Request Forgery), arises when the Camel DNS component reads DNS operation parameters from Exchange message headers that use plain strings such as dns.server, dns.name, dns.domain, dns.type, dns.class, and term. Because those names do not start with the Camel prefix, the HTTP header filter that blocks only the Camel header namespace fails to block them, allowing an unauthenticated HTTP client to pass them directly into the Exchange. The attacker can therefore instruct the DNS producer to build a SimpleResolver pointing at an attacker‑controlled DNS server, execute DNS queries, observe the responses, and provide poisoned replies, resulting in a server‑side request forgery via DNS. The attacker can also set dns.name or dns.domain to resolve arbitrary internal hostnames, revealing their existence and enabling internal network reconnaissance, all without authentication.

Apache Camel DNS component from Apache Software Foundation, versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.9 are vulnerable.

Based on the description, it is inferred that an unauthenticated HTTP client can act as the attack vector. The EPSS score is below 1% and the vulnerability is not listed in the KEV catalog, indicating a low but non‑zero probability of exploitation. The severity, reflected in a CVSS score of 9.1, denotes a high‑tier threat. The attack vector is an unauthenticated HTTP client, and the impact can range from internal domain enumeration to DNS cache poisoning, depending on the target environment. The vulnerability is especially dangerous in environments where queries are not strictly controlled.