---
id: "CVE-2025-29891"
kind: "vulnerability"
aliases: ["CVE-2025-29891"]
title: "Apache Camel: header bypass lets a crafted request inject into routes"
severity: "medium"
cvss: 4.8
epss: 0.76087
exploited: false
status: "open"
category: "package"
products: [{"name": "apache camel", "fixed": ["3.22.4"], "affected": ">= 3.10.0, < 3.22.4", "ecosystem": "vendor"}, {"name": "apache camel", "fixed": ["4.8.5"], "affected": ">= 4.8.0, < 4.8.5", "ecosystem": "vendor"}, {"name": "apache camel", "fixed": ["4.10.2"], "affected": ">= 4.10.0, < 4.10.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["akamai", "apache-camel", "integration", "java", "lab-disclosure", "package"]
not_affected_if: ["unknown"]
published_at: "2025-03-12T15:15:40+00:00"
first_seen_at: "2026-10-24T18:43:45+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29891", "first_seen_at": "2026-10-24T18:53:56+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-29891", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Apache Camel: header bypass lets a crafted request inject into routes

CVE-2025-29891 is a bypass and injection flaw in Apache Camel, a Java integration library, reported by Akamai in a lab disclosure. The sources describe it as a bypass of a previous fix for remote code execution, closed by CVE-2025-27636 in the same report, and the NVD score is CVSS 4.8 (medium).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache camel affected >= 3.10.0, < 3.22.4 fixed 3.22.4
- vendor:apache camel affected >= 4.8.0, < 4.8.5 fixed 4.8.5
- vendor:apache camel affected >= 4.10.0, < 4.10.2 fixed 4.10.2

## How to check

- Run `mvn dependency:list | grep camel` or check the Camel version in the project's pom.xml or build.gradle, and compare against the affected ranges.
- Look for camel-core and camel-* artifacts at 3.10.0 up to, but not including, 3.22.4, or at 4.8.0 up to, but not including, 4.8.5, or at 4.10.0 up to, but not including, 4.10.2.

## Fix

- Upgrade Apache Camel 3.x to `3.22.4` or later.
- Upgrade Apache Camel 4.8.x to `4.8.5` or later.
- Upgrade Apache Camel 4.10.x to `4.10.2` or later.

## Timeline

- 2026-10-24T18:43:45+00:00 lab https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses — Akamai: Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai
- 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-29891
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-29891

## Documents

- [advisory] Akamai: Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses

## From the sources

Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai

# Zero-Day Dominance: How Akamai Defends Before the Industry Discloses 

 August 28, 2026 by Danielle Walter 

## Key takeaways 

Modern zero-day defense requires moving beyond disconnected point products to a unified web application and API protection (WAAP) platform with shared intelligence.
Multi-day deployment delays leave live enterprise systems exposed to machine-speed attacks, while unvalidated global updates risk triggering severe false positives and catastrophic application downtime.
The Akamai Security Intelligence Group is capable of delivering proactive inline protection days before public vulnerability disclosure and competitor signature releases.
Achieving structural resilience relies on staged validation — combining synthetic lab testing, edge shadow mode, and phased zone rollouts — to provide rapid defense while maintaining total platform availability.

Every modern business runs on applications, which means that your digital operations are only as safe as your ability to block an exploit before the industry even knows it exists. Attackers, whether human or AI-assisted, are no longer limited to testing your web application firewall (WAF) with basic injections; they are executing complex campaigns that chain together automated botnets, API vulnerabilities, and zero-days to compromise live back-end logic.

For security leaders, stopping these fast-moving threats requires transcending disconnected point products and shifting to a unified architecture with a shared data model.

For enterprise buyers, the benchmark for application defense has fundamentally shifted from individual point product efficacy to the operational synergy of a unified web application protection platform.

Achieving structural resilience demands a shared architectural context and a cohesive data model capable of interaction-time decision-making. Akamai’s proactive zero-day mitigation model evaluates the structural architectural discrepancies that separate true platform reliability from fragile, un-staged security deployment models.

## Proactive vs. reactive vulnerability lifecycles 

When high-profile Common Vulnerabilities and Exposures (CVEs) surface, the window between public disclosure and global weaponization shrinks dramatically. Insight across several major exploit lifecycles illustrates the clear operational gap between proactive threat intelligence and reactive emergency rule patching.

When a zero-day vulnerability goes live, response speed becomes a critical factor in reducing risk exposure. Let’s explore the timelines from two major exploit lifecycles to evaluate how threat interception agility splits the application security market.

- The Apache Camel vulnerability lifecycle (March 2025)
- The React Server Components vulnerability lifecycle (December 2025)

### The Apache Camel vulnerability lifecycle (March 2025) 

When critical infrastructure vulnerabilities break, enterprise risk exposure is calculated in elapsed hours. The disclosure and mitigation tracking for the Apache Camel remote code execution (RCE) vulnerabilities (CVE-2025-29891 and CVE-2025-27636) demonstrate the immense delta in response execution between a proactive platform and reactive signatures.

- Friday, March 7: After collaborating with Apache, the Akamai Security Intelligence Group deployed a Rapid Rule, proactive inline protection mechanisms from day zero, that remained under embargo until March 9.
- Sunday, March 9: Following a 48-hour weekend exposure gap, F5 positioned its initial defensive protections.
- Tuesday, March 11

- Cloudflare pushed its mitigation updates online. For highly targeted enterprise environments, this represents a significant four-day structural vacuum during which core application assets were left exposed to active threat scanning. However, they revisited this update in a blog post nearly a month later (see The true cost of inaccuracy).
- Akamai worked closely with Citi Cyber Security Operations to identify and report the bypass to the Apache security team — resulting in a new CVE (CVE-2025-27636), with protection updates deployed to the original Rapid Rule to cover both CVEs. 
- Wednesday, March 12: Nearly a week after discovery, competitive tracking confirmed that major vendors such as Fastly and Imperva still possessed no active defensive counter measures or public indicators.

The true cost of inaccuracy A delayed security response can increase customer operational burden as teams implement temporary mitigations while waiting for vendor protections. The expectation is that when those protections arrive, they will be accurate and reliable. The Apache Camel response illustrates the consequences when both speed and detection accuracy fall short.

Nearly a month after the initial discovery, Cloudflare posted that its reactive rule actions for Apache Camel (CVE-2025-29891) induced massive system instability across their network. Lacking staged validation on real traffic data, the rule triggered high false-positive rates that blocked legitimate customer transactions until their security operations center completely pulled the kill switch and disabled protection at 17:03 UTC.

### The React Server Components vulnerability lifecycle (December 2025) 

The vulnerabilities hitting server-side web frameworks in late 2025 brought threats directly up the application stack, turning standard web actions into code execution bypasses. The mitigation and update log for CVE-2025-55182 outlines the difference between real-time security iteration and unvalidated production updates.

- Monday, December 2: Akamai deployed core safeguards into the environment via Rapid Rule 3000976, keeping public communications under strict embargo until Tuesday, December 3. Cloudflare asserted an identical protective baseline deployment date in a late post on December 3.
- Tuesday, December 3: AWS pushed their public threat signature update online.
- Wednesday, December 4 – Thursday, December 5: Rather than treating mitigation as a one-time rule deployment, the Akamai Security Intelligence Group continuously monitored exploitation activity, analyzed emerging attack variants, and released three successive rule iterations (v1, v2, v3) over a 48-hour window. This agile approach adapted protections to the evolving threat while maintaining high enforcement accuracy.
- Thursday, December 4: F5, Imperva, and Google deployed defensive protections into their stacks.
- Friday, December 5: Microsoft Azure rolled out their protection rules. Concurrently, Cloudflare released an untested global update to their security system regarding CVE-2025-55182. Without staged canary testing or validation, the signature change triggered an active loop failure, inducing a significant outage that took customer applications entirely offline.

## The structural implications of reactive vs. staged security postures 

The data from these threat lifecycles strips away marketing hyperbole and exposes a fundamental operational truth: A security control that compromises availability during a threat event can become a source of operational risk itself. Security effectiveness is measured by both detection efficacy and by the platform's ability to safely deploy, validate, and isolate protections as threats evolve.

Organizations that rely on an application protection platform with delayed response cycles or architectures with rule-processing failures inherently accept two compounding structural vulnerabilities, including:

- The exposure vacuum
- Blast radius vulnerability

### The exposure vacuum 

A multi-day delay in zero-day rule deployment leaves live systems completely defenseless while adversaries weaponize open source scanners at machine speed. In high-stakes web environments, assuming that an exploit won't hit your endpoints during a 48- to 96-hour window is a massive corporate gamble.

### Blast radius vulnerability 

Web application ar

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_