CVE-2026-85314— Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)
Quick assessment
Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Camel Mail 组件存在输入验证不当的漏洞。 该问题影响 Apache Camel 的以下版本范围：4.0.0 至 4.18.4（含），以及 4.19.0 至 4.22.0（含）。 此前 CVE-2026-46584 已修复了邮件头未经过滤器处理即传入 Exchange 的问题，但 MimeMultipart 数据格式仍保留了一条未受过滤的路径：在反序列化多部分（multipart）消息时，mail.smtp 命名空间的邮件头被直接映射到 Exchange，而未应用任何过滤。由于这些头名称位于
Affected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.0.0< 4.18.5 |
affected |
4.19.0< 4.22.1 |
affected | ||
4.18.5 |
unaffected | ||
4.22.1 |
unaffected | ||
4.23.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85314
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Input Validation vulnerability in Apache Camel Mail component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied. Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends. This is an incomplete fix of CVE-2026-46584 rather than a new class of defect: a deployment that applied that advisory and considered camel-mail settled remained exposed on this path.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The MimeMultipart data format now applies the header filter on unmarshal, closing the path CVE-2026-46584 left open. For deployments that cannot upgrade immediately, strip the namespace after the data format with removeHeaders("mail.smtp*") before any mail producer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.0.0 ~ 4.18.5 | - |
|
II. Public POCs for CVE-2026-85314
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85314
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85314 (3)
Vendor Advisories for CVE-2026-85314 (1)
Vendor Pages for CVE-2026-85314 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-19 · 62 CVEs total
| CVE-2026-78162 | 10.0 CRITICAL | Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom |
| CVE-2026-88900 | 8.8 HIGH | Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroup |
| CVE-2026-83531 | 8.8 HIGH | Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie |
| CVE-2026-78165 | 8.8 HIGH | Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads |
| CVE-2026-80312 | 8.2 HIGH | Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors |
| CVE-2026-80344 | 8.2 HIGH | Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro |
| CVE-2026-80343 | 8.2 HIGH | Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path |
| CVE-2026-78164 | 8.2 HIGH | Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid |
| CVE-2026-88901 | 8.2 HIGH | Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by d |
| CVE-2026-85251 | 7.5 HIGH | Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets |
| CVE-2026-85250 | 7.5 HIGH | Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum |
| CVE-2026-79984 | 7.4 HIGH | Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name repo |
| CVE-2026-79985 | 7.4 HIGH | Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i |
| CVE-2026-79986 | 7.4 HIGH | Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re |
| CVE-2026-79983 | 7.4 HIGH | Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i |
| CVE-2026-91858 | 6.5 MEDIUM | Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh |
| CVE-2026-84176 | 6.5 MEDIUM | Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig |
| CVE-2026-85296 | 6.5 MEDIUM | Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State |
| CVE-2026-85254 | 6.5 MEDIUM | Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name |
| CVE-2026-85249 | 6.5 MEDIUM | Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata |
Showing top 20 of 62 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Camel
-
CVE-2026-88900
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of -
CVE-2026-91858
Apache Camel: Camel-FOP Resolves External DTDs and Entities -
CVE-2026-88901
Apache Camel: Camel-Smooks XML External Entity Processing, e -
CVE-2026-85317
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under -
CVE-2026-85316
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via
Same vendor: Apache Software Foundation
-
CVE-2026-107755
Apache CouchDB: Credential Disclosure to Non-Owner Members v -
CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicat -
CVE-2026-90799
Apache CouchDB: Atom-table exhaustion in _changes sequences -
CVE-2026-90798
Apache CouchDB: Replicator follows redirects indefinitely -
CVE-2026-90797
Apache CouchDB: Pre-authentication gzip decompression bomb v
Same weakness: CWE-20
-
CVE-2026-92287
Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL i -
CVE-2026-110180
fast-uri vulnerable to host confusion via unchecked WHATWG h -
CVE-2026-55644
Element X iOS: io.element.call deeplink allows attacker-cont -
CVE-2026-85312
Apache Camel: Camel-Core Saga Participation Hijacking via th -
CVE-2026-85249
Apache Camel: Camel-Tika Header Injection via Unfiltered Doc
V. Comments for CVE-2026-85314
No comments yet