Improper Input Validation in Apache Camel's Tika Component Affects Multiple Versions

CVE-2026-85249

What is CVE-2026-85249?

The vulnerability in Apache Camel’s Tika component arises from improper input validation, allowing attacker-controlled document metadata to be injected as headers into the Exchange. This can lead to a serious breach where the document's metadata influences downstream processing, potentially compromising the integrity of the application. Affected users are advised to upgrade to Apache Camel 4.23.0, where the issue is resolved, or to the respective LTS versions of 4.18.5 or 4.22.1. For immediate mitigation, users should implement header stripping to remove sensitive Camel namespace headers using removeHeaders("Camel*"). The oversight in the header mapping process underscores the need for stringent validation protocols to safeguard against similar vulnerabilities.

References