CVE-2026-33454

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 4.19.0

Description A flaw in the Camel-Mail component allows an attacker to perform message header injection by sending a specially crafted email to a mailbox monitored by a Camel application. Due to a missing inbound filter in the MailHeaderFilterStrategy, malicious headers are not properly filtered, which can alter the behavior of downstream components. This issue involves the setOutFilterStartsWith() function and deficiencies in the deserialization mechanism, potentially leading to remote code execution (RCE), where an attacker can execute arbitrary code on the system.

Recommendations Update to version 4.19.0 or the latest supported LTS release.