CVE-2026-85314
Received Received - Intake

Improper Input Validation in Apache Camel Mail

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied. Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends. This is an incomplete fix of CVE-2026-46584 rather than a new class of defect: a deployment that applied that advisory and considered camel-mail settled remained exposed on this path. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The MimeMultipart data format now applies the header filter on unmarshal, closing the path CVE-2026-46584 left open. For deployments that cannot upgrade immediately, strip the namespace after the data format with removeHeaders("mail.smtp*") before any mail producer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85314
EUVD
EUVD-2026-104202

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85314 is an improper input validation vulnerability in Apache Camel's mail component. It involves the MimeMultipart data format not applying header filters during unmarshaling, allowing external mail messages to inject JavaMail session properties into the exchange. This bypasses the header filtering meant to block mail.smtp headers, potentially influencing downstream mail producers.

Impact Analysis

An attacker could craft a malicious email to inject headers that control mail session properties. This might lead to unauthorized mail transmission, data leaks, or manipulation of mail routing. Systems processing untrusted emails are at risk if not patched.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive email data or facilitating data exfiltration. Non-compliance risks include legal penalties and reputational damage due to insufficient input validation controls.

Mitigation Strategies
  • Upgrade Apache Camel to version 4.23.0 or apply the latest patches for your release stream (4.18.5 for 4.18.x LTS or 4.22.1 for 4.22.x LTS).
  • If immediate upgrade is not possible, use the workaround: apply removeHeaders("mail.smtp*") after the MimeMultipart data format to strip unfiltered headers before mail producers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart