Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-85314

CVE-2026-85314 is covered by the Apache CVE-2026-85314 security bulletin. Not in the CISA KEV catalog. Medium advisory severity. 1 advisory from Apache.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-85314 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
Vendor advisories
1 from Apache
VulniPulse record
Published · Updated

Is CVE-2026-85314 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-85314 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-85314?

This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium6.5

    Medium [CVE-2026-46584 +1] Improper Input Validation vulnerability in Apache Camel Mail component

    CVE-2026-85314Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied. Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends. This is an incomplete fix of CVE-2026-46584 rather than a new class of defect: a deployment that applied that advisory and considered camel-mail…

    Affected products in this advisory
    • Apache Camel Mail
    Source-reported affected versions
    • 4.0.0 before 4.18.5
    • 4.19.0 before 4.22.1
    Source-reported fixed versions
    • 4.18.5
    • 4.22.1
    Mitigation guidance
    • Upgrade to Apache Camel 4.23.0, which fixes the issue.
    • Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
    • Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
    • For deployments that cannot upgrade immediately, strip the namespace after the data format with removeHeaders("mail.smtp*") before any mail producer.
    Workarounds
    • Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Apache CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features