CVE-2026-85314: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel

This vulnerability in Apache Camel's Mail component arises because the MimeMultipart data format does not apply the necessary header filter when unmarshalling multipart messages. As a result, mail.smtp headers can be set by external senders and influence how downstream mail producers connect and send messages. This issue is a partial fix regression of CVE-2026-46584, meaning that deployments that applied the previous fix but did not upgrade further remain exposed. The vulnerability affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The fix is included in versions 4.18.5, 4.22.1, and 4.23.0. For those who cannot upgrade immediately, a workaround is to remove mail.smtp headers after unmarshalling using removeHeaders("mail.smtp*").

An attacker can craft multipart email messages with mail.smtp headers that bypass the intended header filtering, potentially influencing how downstream mail producers send mail. This could lead to unauthorized manipulation of mail sending behavior, impacting confidentiality and integrity of mail operations. The CVSS 3.1 score is 6.5 (medium severity), indicating a network attack vector with low complexity and no privileges or user interaction required, causing low confidentiality and integrity impact but no availability impact.

A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to one of these versions to fully remediate the vulnerability. For deployments that cannot upgrade immediately, it is recommended to apply a temporary mitigation by stripping mail.smtp headers after unmarshalling using removeHeaders("mail.smtp*") before any mail producer processes the message.