The vulnerability in Apache Camel's Camel-Mail component arises because the custom header filter strategy only filters outbound headers but does not filter inbound headers. Consequently, when consuming mail via protocols like IMAP or POP3, inbound Camel-prefixed MIME headers are mapped into the Exchange without filtering. An attacker capable of delivering email to a mailbox monitored by such a consumer can inject Camel-specific headers. These injected headers can influence the behavior of downstream Camel components such as camel-bean, camel-exec, or camel-sql, potentially altering route execution. This issue is related to previously addressed header injection vulnerabilities in other Camel components. The vulnerability affects Apache Camel versions from 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1. The vendor recommends upgrading to 4.19.0 or the latest patch releases in the affected LTS streams.

An attacker who can send email to a mailbox consumed by Apache Camel's vulnerable Camel-Mail component can inject malicious Camel-specific headers. This can lead to altered application behavior in downstream components, potentially causing unauthorized actions or logic manipulation within the affected Camel routes. The CVSS score of 9.4 indicates a critical impact with high confidentiality and integrity impact and low attack complexity, requiring no privileges or user interaction.

Upgrades are available to remediate this vulnerability. Users should upgrade to Apache Camel version 4.19.0, or if using the 4.18.x LTS stream, upgrade to 4.18.1, and if using the 4.14.x LTS stream, upgrade to 4.14.6. These versions include fixes for the header injection issue. No alternative mitigations or temporary workarounds are indicated in the vendor advisory. Patch status is confirmed by vendor advisories from Red Hat.