Loading...
Skip to main content
GeekWala

CVE-2026-33453 — Vulnerability in org.apache.camel:camel-coap —...

CRITICAL

Apache camel-coap allows header injection that can lead to remote code execution

Published April 27, 2026Updated May 5, 2026Source: osv

Summary

Apache Camel's camel-coap component is vulnerable to header injection because it maps CoAP request URI query parameters directly into Camel message headers without applying a HeaderFilterStrategy. An unauthenticated attacker can send a crafted CoAP request to inject arbitrary Camel internal headers into the exchange. When a vulnerable route forwards that exchange to a header-sensitive downstream producer, the attacker may be able to control producer behavior. For example, in routes using camel-exec, injected headers can override the configured executable and arguments, which can result in arbitrary command execution with the privileges of the Camel process. Command output may be returned to the attacker in the CoAP response. This issue affects org.apache.camel:camel-coap from 4.14.0 through 4.14.5 and from 4.18.0 before 4.18.1. It is fixed in 4.14.6, 4.18.1, and 4.19.0.

Advisory Timeline

  • First published April 27, 2026 (168 days ago).
  • Last revised May 5, 2026 — 8 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.apache.camel:camel-coap to 4.18.1 or later
<!-- Update pom.xml dependency version to 4.18.1 for org.apache.camel:camel-coap -->
Maven
Update org.apache.camel:camel-coap to 4.14.6 or later
<!-- Update pom.xml dependency version to 4.14.6 for org.apache.camel:camel-coap -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.apache.camel:camel-coap
maven
4.18.04.18.1
org.apache.camel:camel-coap
maven
4.14.0, 4.14.1, 4.14.2, 4.14.3 (+2 more)4.14.6

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 10.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-33453?
Apache camel-coap allows header injection that can lead to remote code execution This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 10.0/10).
How do I check if my project is affected by CVE-2026-33453?
CVE-2026-33453 affects org.apache.camel:camel-coap. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33453 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
10.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-695c-x5gc-94gj

Related CVEs

  • CVE-2026-33454
    CRITICAL

    Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

  • CVE-2026-40453
    CRITICAL

    Apache Camel has an incomplete fix for CVE-2025-27636

  • CVE-2026-40860
    CRITICAL

    Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

  • CVE-2026-40022
    HIGH

    Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

  • CVE-2026-40859
    HIGH

    Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

  • CVE-2026-42527
    HIGH

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  • CVE-2026-43866
    HIGH

    Apache Camel JMS deserialization filter bypass

  • CVE-2026-46592
    HIGH

    Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies