CVE-2026-85254
Received Received - Intake

Case-Insensitive Header Handling Flaw in Apache Camel

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by varying the case of the header name. HTTP/2 makes the problem unconditional rather than optional: the protocol requires header names to be lowercase on the wire, so the comparison never matched and the suppression was inert for every request on an HTTP/2 connection. The consequence is that content the caller chose is echoed back in the response, which is the basis for response-splitting and cache-poisoning style attacks against whatever sits in front of the Camel endpoint. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Request header names are now compared case insensitively, so the suppression holds regardless of casing and works under HTTP/2. For deployments that cannot upgrade immediately, strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather than relying on the built-in suppression.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85254
EUVD
EUVD-2026-104194

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85254 is an improper handling of case sensitivity vulnerability in Apache Camel's Platform HTTP component. The issue occurs because header name comparisons for suppressing request headers in responses are case-sensitive, while HTTP headers are inherently case-insensitive. Attackers can bypass this suppression by altering header name casing or using HTTP/2, where headers are always lowercase. This allows sensitive request headers to be echoed back in responses, enabling response-splitting and cache-poisoning attacks against systems using Camel endpoints.

Detection Guidance

To detect this vulnerability, check Apache Camel versions in use. Affected versions are 4.0.0 to 4.18.4, 4.19.0 to 4.22.0. Run: 'camel --version' or check your application's dependency tree. Monitor HTTP responses for unexpected header echoes, especially for headers like Authorization or Cookie. Use tools like curl to inspect responses: 'curl -v http://your-camel-endpoint' and look for reflected headers.

Impact Analysis

This vulnerability could allow attackers to inject malicious content into responses, leading to response-splitting attacks that may compromise user sessions or enable phishing. Cache-poisoning attacks could alter cached content, exposing users to incorrect or malicious data. Sensitive headers like Authorization or Cookie may be leaked in responses, risking credential exposure and unauthorized access to protected resources.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Failure to address this issue may result in non-compliance with these regulations, potentially leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Apache Camel to fixed versions: 4.18.5, 4.22.1, or 4.23.0. If upgrading is not possible, strip problematic headers before they reach Camel or remove them from responses within the route. For HTTP/2 traffic, ensure header suppression is enforced regardless of casing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart