The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filte…

CVE-2026-40453 affects Apache Camel versions 3.0.0-4.14.6, 4.15.0-4.18.2, and 4.19.0-4.20.0. The vulnerability stems from incomplete fixes for CVE-2025-27636, where setLowerCase(true) was not applied to five non-HTTP HeaderFilterStrategy implementations. This allows attackers with JMS producer access to inject case-variant Camel internal headers, bypassing case-sensitive filtering. The vulnerability enables remote code execution and arbitrary file writes on routes forwarding JMS messages to header-driven components like camel-exec and camel-file. Affected implementations include JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy, SjmsHeaderFilterStrategy, CoAPHeaderFilterStrategy, and GooglePubsubHeaderFilterStrategy. Users should upgrade to version 4.20.0, 4.14.6 for LTS users, or 4.18.2 for 4.18.x stream users.