An instance of case‑sensitive header name comparison in the Camel Platform HTTP component causes request headers to be reflected in responses if their names are submitted with a different case than stored. The bug allows a client to pass a header such as 'Set-Cookie' with altered casing; the built‑in suppression mechanism fails to block it, resulting in the value being returned to the caller. This flaw can be leveraged to perform response‑splitting or cache‑poisoning attacks against systems that sit in front of the Camel endpoint, potentially leading to data leakage or cross‑site request forgery.

The vulnerability affects Apache Camel for all releases starting from 4.0.0 up to 4.18.4, starting from 4.19.0 up to 4.22.0, and any earlier 4.x series that has not been patched. Users of the 4.18.x long‑term support stream should upgrade to 4.18.5, while those on the 4.22.x stream should upgrade to 4.22.1. The most recent version, 4.23.0, contains the patch that applies case‑insensitive comparison for header names and restores suppression functionality under HTTP/2.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is not listed, and the vulnerability is not present in CISA's KEV catalog, suggesting a lower likelihood of widespread exploitation at present. An attacker can trigger the flaw by sending a crafted HTTP request with a header name that differs only in letter case on a public or internal Camel endpoint. Because HTTP/2 requires lowercase header names, the suppression remains broken for every request over HTTP/2, giving attackers a reliable attack surface. The impact is limited to the Camel component’s response handling and would require the attacker to control a client that can influence request headers to succeed.