CVE-2026-85249: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel

The vulnerability in Apache Camel's Tika component arises because metadata keys parsed from submitted documents are directly mapped onto the Exchange as headers without any filtering. Since document metadata is attacker-controlled, a crafted document can inject headers, including those in the Camel namespace like CamelFileName, which downstream components rely on for routing and file handling. This header injection can alter the behavior of routes processing the document. The affected versions are Apache Camel from 4.0.0 up to but not including 4.18.5, and from 4.19.0 up to but not including 4.22.1. The issue is addressed by filtering metadata headers through a HeaderFilterStrategy before mapping onto the Exchange starting in versions 4.18.5 and 4.22.1, with a full fix in 4.23.0. For those who cannot upgrade immediately, a workaround is to remove Camel namespace headers after the Tika producer using removeHeaders("Camel*").

An attacker supplying a crafted document can control metadata keys that become Exchange headers, potentially influencing route behavior such as file naming and content routing. This can lead to unintended processing or misrouting of data within Apache Camel routes. The impact is limited to confidentiality and integrity (partial control over headers), with no reported availability impact. The CVSS score of 6.5 reflects a medium severity level.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, or to 4.22.1 if using the 4.22.x LTS stream. For full resolution, upgrade to 4.23.0 or later. If immediate upgrade is not possible, mitigate by removing Camel namespace headers after the Tika producer using removeHeaders("Camel*") to prevent malicious headers from affecting downstream components.