Input validation error in Apache Camel - CVE-2026-85314
Published: October 23, 2026
Vulnerability identifier: #VU157313
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85314
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to manipulate downstream mail connections and message delivery, potentially disclosing sensitive message information.
The vulnerability exists due to improper input validation in the Apache Camel Mail component's MimeMultipart data format when unmarshalling multipart messages maps mail.smtp headers onto the Exchange without applying a header filter. A remote attacker can send a multipart message containing crafted mail.smtp headers to influence how a downstream mail producer connects and sends messages, potentially altering delivery behavior and exposing message information.
Affected software
Apache Camel
How to mitigate CVE-2026-85314
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1