Executive brief
Apache Camel is an integration framework used to connect different software applications. A vulnerability in its DNS component allows attackers to redirect network lookups to malicious servers or map out internal company networks. This could lead to the exposure of sensitive internal hostnames or the redirection of traffic to fraudulent destinations.
Technical details
The camel-dns component fails to properly validate or filter specific DNS operation headers (such as dns.server, dns.name, and dns.domain) when they are passed through an HTTP boundary. Because these headers lack the standard 'Camel' prefix, the default HttpHeaderFilterStrategy does not block them, allowing an unauthenticated remote attacker to inject these values via inbound HTTP requests. By setting the 'dns.server' header, an attacker can force the producer to use a malicious DNS resolver (SSRF), enabling DNS cache poisoning or observation of internal queries. Additionally, manipulating 'dns.name' allows for internal network reconnaissance by resolving arbitrary internal hostnames. The issue is resolved in versions 4.14.8, 4.18.3, and 4.21.0 by moving to a protected header namespace.
Affected products
- Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.9
Timeline
- 2026-07-05: disclosed: Initial disclosure on oss-security mailing list
- 2026-07-06: advisory: GitHub Advisory and NVD publication
- 2026-07-24: other: Advisory updated and reviewed