Input Validation Flaw in Apache Camel Affects Header Processing

CVE-2026-59230

What is CVE-2026-59230?

An improper input validation vulnerability in Apache Camel affects the handling of MIME multipart messages within the camel-mail component. When configured with headersInline set to true, the component indiscriminately copies MIME headers from incoming messages to Camel messages, lacking any header filtering strategy. This can allow an attacker controlling the message to inject headers that fall within the Camel-internal namespace, potentially altering the behavior of downstream components in unexpected ways. The vulnerability spans multiple versions of Apache Camel: 2.17.0 to 4.14.8, 4.15.0 to 4.18.3, and 4.19.0 to 4.21.9. Users are advised to upgrade to version 4.22.0 or the relevant LTS versions to mitigate risks. In instances where immediate upgrades aren't feasible, leaving headersInline set to false and sanitizing Camel-internal headers post-unmarshal can help reduce exposure.

References