CVE-2026-33454: Apache Camel Mail Component Vulnerable to Message Header Injection
Summary
CVE-2026-33454: Apache Camel's Camel-Mail component is vulnerable to Camel message header injection. Affects org.apache.camel:camel-mail across 2 version ranges.
>= 3.0.0, < 4.14.6
>= 4.15.0, < 4.18.1
Fixed in 4.14.6 or 4.18.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that allows developers to integrate various applications using a wide range of protocols and data formats. The Camel-Mail component specifically facilitates email handling, enabling applications to send and receive emails through various protocols like IMAP and POP3. This component is widely used in enterprise applications for email processing and notification systems.
Vulnerability Detail
The Camel-Mail component is vulnerable to Camel message header injection due to a flaw in its custom header filter strategy, MailHeaderFilterStrategy. This strategy only filters headers in the 'out' direction and fails to configure the 'in' direction. Consequently, when emails are consumed through Camel, Camel-prefixed MIME headers can be injected unfiltered into the Exchange. An attacker can exploit this by sending crafted emails to a monitored mailbox, potentially altering the behavior of downstream Camel components such as camel-bean, camel-exec, or camel-sql. This vulnerability is similar to previously addressed issues in other Camel components.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 4.14.64.14.6 -
>= 4.15.0, < 4.18.14.18.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can implement custom filtering logic in their application to sanitize incoming headers before processing them. However, this is not a complete solution and should not replace upgrading to the patched version.
Conclusion
CVE-2026-33454 represents a critical vulnerability in the Apache Camel Mail component, allowing for message header injection due to inadequate filtering of incoming headers. Users are strongly advised to upgrade to the latest patched versions to mitigate the risk of exploitation.
See every vulnerability recorded for org.apache.camel:camel-mail →
FAQ
CVE-2026-33454 is a vulnerability in the Apache Camel Mail component that allows for message header injection due to improper filtering of incoming headers.
An attacker can exploit this vulnerability to inject malicious headers into your application, potentially altering the behavior of downstream components and leading to unauthorized actions.
The vulnerability affects Apache Camel versions from 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground to analyze your pom.xml without any signup.
The CVSS score for CVE-2026-33454 is 9.4, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-mail.
