CVE-2026-59230: CWE-20 Improper input validation in Apache Software Foundation Apache Camel

CVE-2026-59230 is an improper input validation vulnerability in Apache Camel's camel-mail component. When the MimeMultipart data format is used with headersInline=true, MIME headers from incoming messages are copied directly onto Camel message headers without applying a header filter strategy. This allows an attacker controlling the MIME message to inject headers in the Camel-internal namespace, which can override configured behavior in downstream components such as camel-sql. The vulnerability has existed since version 2.17.0 and affects multiple release streams until fixed in 4.14.9, 4.18.4, and 4.22.0. The default configuration (headersInline=false) is not affected. Mitigation includes upgrading to fixed versions or disabling headersInline and removing Camel-internal headers after unmarshalling.

An attacker able to influence MIME messages processed by the camel-mail component with headersInline enabled can inject headers that alter the behavior of downstream route steps. This can lead to unintended execution of commands or queries if the route uses these headers for control, potentially causing information disclosure or unauthorized actions. The impact depends on the specific route configuration and which sinks are reachable after the unmarshal step. The CVSS score is 6.5 (medium severity) reflecting limited confidentiality and integrity impact without availability impact.

A fix is available in Apache Camel versions 4.22.0, 4.14.9, and 4.18.4. Users are strongly recommended to upgrade to these versions. For those unable to upgrade immediately, keep the headersInline option set to false (the default) to avoid the vulnerable code path. If headersInline must be enabled, immediately remove Camel-internal headers after unmarshalling (e.g., using removeHeaders("Camel*")) before any processor or producer that reads control headers. Avoid unmarshalling MIME content from untrusted senders into routes that dispatch on header values. Treat all MIME header names from outside the trust boundary as untrusted input.