CVE-2026-59230

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.17.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x

Description Improper input validation in the camel-mail component's MimeMultipart data format allows a sender to inject headers into the Camel Exchange. When the headersInline variable is set to true, the unmarshal process copies MIME headers from the incoming message to the Camel message without applying a HeaderFilterStrategy. An attacker can provide headers within the Camel-internal namespace to override the configured behavior of downstream components. For example, the camel-sql producer may execute a statement provided via an injected header. The impact depends on the route configuration following the unmarshal step. This issue only occurs when headersInline is enabled.

Recommendations Upgrade to version 4.22.0. Upgrade to version 4.14.9 for those on the 4.14.x LTS stream. Upgrade to version 4.18.4 for those on the 4.18.x stream. Set the headersInline variable to false if inline headers are not required. Use removeHeaders("Camel*") immediately after the unmarshal step to strip Camel-internal headers before they reach any processor or producer. Avoid unmarshalling MIME content from untrusted senders in routes that dispatch based on header values. Treat all MIME header names from outside the trust boundary as untrusted input.