CVE-2026-85314
Camel-Mail: header injection - the MimeMultipart data format mapped mail.smtp headers onto the Exchange without applying the filter, leaving open the path that CVE-2026-46584 was intended to close
Description
CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied. Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends. This is an incomplete fix of CVE-2026-46584 rather than a new class of defect: a deployment that applied that advisory and considered camel-mail settled remained exposed on this path.
Mitigation
Credit
This issue was discovered by Claude Security Scan Tool
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24419 refers to the various commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/25568 (commit c2bcb24814a806ced928e612ce5da1a6e3658234), backported to camel-4.22.x in https://github.com/apache/camel/pull/25765 (commit 451d3037ee60544cb2158675959416fec5cc5745) and to camel-4.18.x in https://github.com/apache/camel/pull/25766 (commit e25a496381c1330aea16f26136ce02bb818ccccb).
The issue is classified as CWE-20 Improper Input Validation. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later.