CVE-2026-46584

Medium [CVE-2026-46584 +1] Improper Input Validation vulnerability in Apache Camel Mail component

CVE-2026-85314Source published Oct 19, 2026Source updated Oct 19, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied. Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends. This is an incomplete fix of CVE-2026-46584 rather than a new class of defect: a deployment that applied that advisory and considered camel-mail…

Affected products in this advisory

• Apache Camel Mail

Source-reported affected versions

• 4.0.0 before 4.18.5
• 4.19.0 before 4.22.1

Source-reported fixed versions

• 4.18.5
• 4.22.1

Mitigation guidance

• Upgrade to Apache Camel 4.23.0, which fixes the issue.
• Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
• Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
• For deployments that cannot upgrade immediately, strip the namespace after the data format with removeHeaders("mail.smtp*") before any mail producer.

Workarounds

• Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends.

Low [CVE-2026-46584] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel…

CVE-2026-46584Source published Jul 6, 2026Source updated Jul 9, 2026

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values applied as JavaMail session properties, overriding the endpoint configuration. This namespace is Camel-internal - only MailProducer interprets it - and was not blocked by any HeaderFilterStrategy, so the values could originate from any inbound protocol (for example platform-http query parameters or request headers, or JMS / Kafka messages from untrusted producers) that feeds a route ending in an smtp / smtps producer without an intervening…

Affected products in this advisory

• Apache Camel Mail

Source-reported affected versions

• 4.0.0 through 4.14.8
• 4.15.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.19.0
• 4.14.8
• 4.18.3

Mitigation guidance

• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
• After upgrading, the per-message override is disabled by default; enable it only on trusted endpoints with useJavaMailSessionPropertiesFromHeaders=true.

1 more entries in the full advisory.

High [CVE-2026-46584] Credential exposure and information disclosure via improper input validation of mail headers

CVE-2026-46584Source published Jul 6, 2026Source updated Jul 6, 2026

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values applied as JavaMail session properties, overriding the endpoint configuration. This namespace is Camel-internal - only MailProducer interprets it - and was not blocked by any HeaderFilterStrategy, so the values could originate from any inbound protocol (for example platform-http query parameters or request headers, or JMS / Kafka messages from untrusted producers) that feeds a route ending in an smtp / smtps producer without an intervening…

Affected products in this advisory

• Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
• Red Hat build of Apache Camel 4 for Quarkus 3

Source-reported affected versions

• < 4.19.0
• < 4.0.0
• < 4.14.8
• < 4.15.0

2 more entries in the full advisory.

Source-reported fixed versions

• 4.21.0
• 4.14
• 4.14.8
• 4.18

3 more entries in the full advisory.

Mitigation guidance

• To mitigate this vulnerability, ensure that any Camel routes processing untrusted input and forwarding it to the mail producer explicitly strip the `mail.smtp.*` and `mail.smtps.*` header namespaces. This can be achieved by adding `removeHeaders('mail.smtp.*')` and `removeHeaders('mail.smtps.*')` to the route definition between the untrusted ingress and the SMTP/SMTPS producer.