CVE-2026-59230: Apache Camel-Mail Improper Header Handling Vulnerability
Summary
CVE-2026-59230: Improper input validation vulnerability in Apache Camel. Affects org.apache.camel:camel-mail across 3 version ranges.
>= 2.17.0, < 4.14.9
>= 4.15.0, < 4.18.4
>= 4.19.0, < 4.22.0
Fixed in 4.14.9, 4.18.4 or 4.22.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that enables the integration of various systems using a wide range of protocols and data formats. The camel-mail component specifically allows for the handling of email messages, providing functionalities to send and receive emails in a seamless manner. However, a recent vulnerability has been identified in the MimeMultipart data format of the camel-mail component, which can lead to improper handling of MIME headers.
Vulnerability Detail
The vulnerability arises from improper input validation in the camel-mail component of Apache Camel. When the MimeMultipart data format is configured with headersInline set to true, it copies MIME headers from incoming messages onto the Camel message without applying a header filter strategy. This allows an attacker to inject headers that could manipulate the behavior of downstream components in the route, potentially leading to unintended actions or data exposure. The issue affects versions from 2.17.0 to before 4.14.9, from 4.15.0 to before 4.18.4, and from 4.19.0 to before 4.22.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.17.0, < 4.14.94.14.9 -
>= 4.15.0, < 4.18.44.18.4 -
>= 4.19.0, < 4.22.04.22.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, users can mitigate the risk by leaving the headersInline setting at its default value of false, which prevents the copying of headers. If headersInline must remain enabled, users should strip Camel-internal headers immediately after the unmarshal step using the following code:
removeHeaders("Camel*");
Conclusion
The Apache Camel-Mail component has a vulnerability that can lead to improper handling of MIME headers, potentially allowing attackers to manipulate the behavior of the application. Users are advised to upgrade to the latest versions or implement workarounds to mitigate the risk.
See every vulnerability recorded for org.apache.camel:camel-mail →
FAQ
CVE-2026-59230 is a vulnerability in the Apache Camel-Mail component that allows improper handling of MIME headers, potentially leading to security risks.
The vulnerability affects Apache Camel versions from 2.17.0 to before 4.14.9, from 4.15.0 to before 4.18.4, and from 4.19.0 to before 4.22.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the pom.xml file. You can also check your application using the Vulert playground without signup at Vulert Scanner.
It is recommended to upgrade to the latest patched version of the camel-mail component to mitigate the vulnerability.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-mail.
