CVE-2026-46584

CVE-2026-46584 — camel-mail mail.smtp. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CVE-2026-33454

camel-mail Header Injection → RCE Vulnerability Reproducer CVE-2026-33454 This project demonstrates a Camel message header injection vulnerability in Apache Camel's camel-mail component, tracked as CVE-2026-33454. An attacker who can deliver an email to a mailbox monitored by a Camel mail consume...

CVE-2026-85314

CVE-2026-85314 — camel-mail: MimeMultipart header injection mail.smtp Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-mail MimeMultipart data format mapped a message's headers onto the Exchange on unmarshal using a plain DefaultHeaderFilterStrategy, which...

CVE-2026-59230

CVE-2026-59230 — camel-mail MimeMultipart header injection headersInline Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-spring-boot 4.18.2 Camel...

Exploit for CVE-2026-85314

CVE-2026-85314 — camel-mail: MimeMultipart header injection...

Incomplete Filtering of Special Elements

Overview org.apache.camel:camel-mail is a Camel Mail support. Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements via MimeMultipartDataFormat in the camel-mail component. An external sender can supply a multipart message with mail.smtp. or mail.smtps...

org.apache.camel.karaf:camel-mail (4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-mail (3.33.3) +8 more potentially affected by CVE-2026-46584 +1 more via org.apache.camel:camel-mail (4.18.4)

org.apache.camel:camel-mail MAVEN version 4.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-mail and may be impacted: - org.apache.camel.karaf:camel-mail 4.18.4 - org.apache.camel.quarkus:camel-quarkus-integration-test-mail...

org.apache.camel/camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior

A flaw was found in Apache Camel's camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy. An attacker who can provide a crafted MIME message may...

CVE-2026-59230

A flaw was found in Apache Camel's camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy. An attacker who can provide a crafted MIME message may...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview org.apache.camel:camel-mail is a Camel Mail support. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the unmarshal process when headersInline is enabled. An attacker can manipulate...

in.co.diging.services.utility.java:notification-service (1.0.0), io.automatiko.addons.services:automatiko-receive-email-addon (>=0.7.0, <=0.46.0) +44 more potentially affected by CVE-2026-59230 via org.apache.camel:camel-mail (>=2.17.0, <=4.14.8)

org.apache.camel:camel-mail MAVEN version =2.17.0, =0.7.0, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-59230 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-1...

GHSA-CX47-QXP5-MMH2 Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

in.co.diging.services.utility.java:notification-service (1.0.0), io.automatiko.addons.services:automatiko-receive-email-addon (>=0.7.0, <=0.46.0) +44 more potentially affected by CVE-2026-59230 via org.apache.camel:camel-mail (>=2.17.0, <=4.14.8)

org.apache.camel:camel-mail MAVEN version =2.17.0, =0.7.0, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-59230 Source advisory: GHSA-CX47-QXP5-MMH2https...

io.automatiko.addons.services:automatiko-receive-email-addon (>=0.53.0, <=0.55.0), org.apache.camel.quarkus:camel-quarkus-integration-test-mail (>=3.35.0, <=3.38.0) +9 more potentially affected by CVE-2026-59230 via org.apache.camel:camel-mail (>=4.19.0, <=4.21.0)

org.apache.camel:camel-mail MAVEN version =4.19.0, =0.53.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.0.0, =4.0.2 Source cves: CVE-2026-59230 Source advisory: OSV:GHSA-CX47-QXP5-MMH2...

io.automatiko.addons.services:automatiko-receive-email-addon (>=0.53.0, <=0.55.0), org.apache.camel.quarkus:camel-quarkus-integration-test-mail (>=3.35.0, <=3.38.0) +9 more potentially affected by CVE-2026-59230 via org.apache.camel:camel-mail (>=4.19.0, <=4.21.0)

org.apache.camel:camel-mail MAVEN version =4.19.0, =0.53.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.0.0, =4.0.2 Source cves: CVE-2026-59230 Source advisory: GHSA-CX47-QXP5-MMH2...

Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

CVE-2026-59230

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

CVE-2026-59230 Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

CVE-2026-59230 Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

EUVD-2026-64953

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...