CVE-2026-85254 — camel-platform-http: request-header echo suppression bypass (header-name case)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the guard that stops a request header being reflected into the response compared header names case-sensitively, while HTTP header names are case-insensitive. A caller could defeat the suppression simply by varying the case of the header name — and under HTTP/2 it never matched at all, because the protocol requires header names to be lowercase on the wire, so the suppression was inert for every HTTP/2 request. The consequence is that content the caller chose is echoed back in the response (the basis for response-splitting and cache-poisoning attacks), and it reflects the very credential headers (Authorization, Cookie, Proxy-Authorization) the suppression is meant to keep out of the response.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-platform-http-vertx 4.22.0 (affected; fixed 4.22.1), Camel's Vert.x server
Camel Quarkus	camel-quarkus/	Quarkus 3.29.0 + camel-quarkus-platform-http (Camel 4.15.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1)

Both modules demonstrate the affected and the fixed behaviour.

What it demonstrates

A platform-http:/echo endpoint is served. Its HeaderFilterStrategy is supposed to suppress common request headers from the response. The driver checks the strategy directly and also sends a live request carrying a lowercase (HTTP/2-style) credential header.

• Affected: the strategy suppresses Authorization (canonical) but not authorization (lowercase), and a live request carrying authorization: Bearer <secret> is echoed back in the response.
• Fixed: the strategy suppresses the header whatever its casing, and nothing is echoed back.

# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected: lowercase header echoed back; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85254-platform-http-header-echo-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: suppressed; >>> Not exploited

# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected (Camel 4.15.0): lowercase header echoed back
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: suppressed

Vulnerability Summary

Property	Value
Component	camel-platform-http (PlatformHttpEndpoint, COMMON_HTTP_REQUEST_HEADERS)
CWE	CWE-178 (Improper Handling of Case Sensitivity)
Severity	MEDIUM
Attack vector	A request header whose name is cased differently from the canonical spelling (e.g. any HTTP/2 request)
Impact	Caller-chosen header content echoed into the response — response-splitting / cache-poisoning, and reflection of credential headers the suppression is meant to withhold
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24453
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-85254.html

The fix

PlatformHttpEndpoint now holds COMMON_HTTP_REQUEST_HEADERS in a case-insensitive TreeSet(String.CASE_INSENSITIVE_ORDER) instead of a case-sensitive Set.of(...), so the suppression matches regardless of how the caller cased the header name — including the all-lowercase names HTTP/2 requires.

Mitigation if you cannot upgrade

Strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather than relying on the built-in suppression.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The injected header value is an inert local fixture. Do not use this material against systems you do not own or operate.