CVE-2025-29891: 
Java vulnerability analysis and mitigation

CVE-2025-29891 is a high-severity bypass/injection vulnerability discovered in Apache Camel that affects versions 4.10.0 before 4.10.2, 4.8.0 before 4.8.5, and 3.10.0 before 3.22.4. The vulnerability was discovered in March 2025 and is present in Camel's default incoming header filter, allowing attackers to include Camel-specific headers through HTTP request parameters that can alter component behaviors (Apache Advisory).

The vulnerability exists in Camel's default header filtering mechanism where attackers can manipulate application behavior by injecting malicious headers through HTTP request parameters. The flaw affects multiple Camel HTTP components out-of-the-box, including camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http. The headers can be provided both as request parameters for HTTP methods invocation or as part of the payload. This vulnerability is related to CVE-2025-27636, sharing the same root cause but expanding the attack vector to include HTTP parameters (Security Online, Apache Advisory).

The vulnerability allows attackers to manipulate application behavior through header injection, potentially leading to unauthorized method execution in certain Camel components. For applications directly connected to the internet via HTTP, attackers could exploit this vulnerability to alter the intended functionality of the application, particularly affecting components like camel-bean and camel-exec (Apache Advisory).

Users are strongly recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS, or 3.22.4 for 3.x releases. As an additional mitigation measure, users can implement the removeHeaders Enterprise Integration Pattern (EIP) to filter out headers that don't start with 'Camel', 'camel', or 'org.apache.camel' (Apache Advisory).

The vulnerability was initially discovered by Citi Cyber Security Operations and reported by Akamai Security Intelligence Group (SIG). The security community has shown significant interest in this vulnerability, particularly due to its connection to the earlier CVE-2025-27636 and the expanded attack surface it represents (Apache Advisory).