Speed with Precision: Early and Accurate Response to Apache Camel CVEs

Table: Response times to CVE-2025-27636 and CVE-2025-29891: Akamai vs. another popular cybersecurity vendor

When threats emerge, time matters. But so does accuracy. How does Akamai achieve both? Rapid Rules. Akamai’s Rapid Rules capability — the intersection of the technical prowess and hard-working dedication of our threat researchers with App & API Protector’s cutting-edge technology — allows us to deliver near-real-time protections without sacrificing precision.

Rapid Rules have been designed to empower Akamai’s SIG to release security updates in three hours for high-profile vulnerability and threats. In March 2025 alone, in addition to the Apache Camel vulnerabilities, we released protections for three other security issues that block request smuggling attacks and exploitations of an Apache Tomcat vulnerability and a Next.js vulnerability.

To achieve such swift response times, Akamai developed a dedicated infrastructure to support Rapid Rules releases, automated rule development, and a reliable testing framework against shadow customer traffic and process optimizations. In addition, we implemented extensive safety controls that allow us to quickly release rules, rapidly address unwanted behavior, and update the detection logic in a version-controlled manner as an attack evolves.

Furthermore, Rapid Rules enable customers to have a flexible mitigation strategy. This enables an organization to use auto-updates for high-profile threats while maintaining manual control for standard protections. This dual approach allows for robust security without disrupting existing operational workflows. 

Let’s continue our comparison of what happened elsewhere in the industry after the creation of CVE-2025-27636 and CVE-2025-29891. On April 1, the popular cybersecurity vendor updated their system status with an incident report about instability from web application firewall (WAF) false positives tied to what appeared to be an overly broad patch for the Apache Camel bypass (CVE-2025-29891), which in turn led to the denial of legitimate traffic.

By April 2, this vendor's change log showed they deployed a new update to address the bypass.

Deploying protections is important, but so is being precise; failing to be precise can result in other, unintended customer impacts, such as operational disruption, legal fallout, and public relations damage. At Akamai, we believe you shouldn’t have to choose. Our customers expect both — and that’s what we deliver. Quick, precise protection.

Akamai's rapid deployment of protection for Apache Camel vulnerabilities exemplifies our ability to act with both speed and precision — core reasons why customers consistently place their trust in us.

When threats emerge, attackers don’t wait, and neither do we. Backed by our Adaptive Security Engine and Rapid Rules, Akamai can swiftly detect and mitigate novel threats, providing zero-touch updates and using a threat intelligence ecosystem built from one of the largest global networks.

This agility is precisely what Forrester says about Akamai in the latest The Forrester Wave: Web Application Firewall Solutions report: “reference customers loved Akamai’s detection capabilities and appreciated how easy it is to automate functionality.”

As further validation, Akamai has been named a Customers’ Choice for Cloud WAAP by Gartner, an honor we’ve held for five consecutive years. It’s that trusted combination of fast-acting innovation and consistent protection that makes Akamai the vendor that organizations depend on when seconds matter.

The Apache Camel vulnerabilities are a textbook case in modern security response: real-time collaboration, zero-day discovery, and precision-driven rule deployment. This is what happens when a security vendor is embedded into your workflows — not just reacting to the threat landscape, but helping shape it.

At Akamai, we power and protect life online. When it matters most, our customers know who to call.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity here.

GARTNER is a registered trademark and service mark, and PEER INSIGHTS is a registered trademark, of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences with the vendors listed on the platform, should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.

Please note that this report was previously known as Gartner Peer Insights ‘Voice of the Customer’: Web Application and API Protection in 2022 , as Gartner Peer Insights ‘Voice of the Customer’: Web Application Firewalls in 2021 and as Gartner Peer Insights ‘Voice of the Customer’: Web Application Firewalls in 2020.