Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

Executive Summary: In March 2025 Apache disclosed three critical remote-code-execution vulnerabilities — CVE-2025-24813 in Apache Tomcat (abusing partial PUT and session persistence deserialization) and CVE-2025-27636/CVE-2025-29891 in Apache Camel (case-sensitive header filter bypass enabling execution). Palo Alto Networks Unit 42 validated exploitation steps, published PoCs, observed large-scale scanning and active exploit attempts (125,856 probes overall; 7,859 Tomcat attempts), and provided IOCs and mitigation guidance; organizations are advised to patch promptly.