Improper Input Validation in Apache Camel Mail Component
CVE-2026-85314

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
19 October 2026

What is CVE-2026-85314?

An Improper Input Validation vulnerability was identified in the Mail component of Apache Camel, affecting specific versions within the 4.x series. The vulnerability allows external actors to manipulate mail headers that bypass expected filters, potentially leading to unauthorized access and manipulation of mail data during transmission. This flaw, which stems from an incomplete remediation of a prior issue (CVE-2026-46584), necessitates immediate upgrades to the specified secure versions (e.g., 4.23.0 or the relevant LTS releases) to close loopholes and ensure the integrity of message handling processes. Users unable to upgrade can implement a temporary workaround by removing sensitive headers before sending messages.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

References

https://camel.apache.org/security/CVE-2026-85314.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24419
issue-tracking
https://github.com/apache/camel/pull/25568
patch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Andrea Cosentino
.