CVE-2026-59230: Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

[Andrea Cosentino <acosentino () apache org>]

Severity: moderate 

Affected versions:

- Apache Camel (org.apache.camel:camel-mail) 2.17.0 before 4.14.9
- Apache Camel (org.apache.camel:camel-mail) 4.15.0 before 4.18.4
- Apache Camel (org.apache.camel:camel-mail) 4.19.0 before 4.22.0

Description:

Improper input validation vulnerability in Apache Camel.



This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.



The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is 
configured with headersInline set to true, the unmarshal path copies the MIME headers of the incoming message onto the 
Camel message: it enumerates every header that is not one of the three standard ones it generates itself - Message-ID, 
MIME-Version and Content-Type - and calls setHeader for each, applying no HeaderFilterStrategy. The names of those MIME 
headers come from the message being unmarshalled, so a sender able to influence the message could place a header whose 
name falls in the Camel-internal namespace and have it set on the Exchange. Camel components read control headers from 
that namespace to override their configured behaviour - the camel-sql producer, for instance, takes the statement to 
execute from a Camel header when one is present - so an injected header could redirect what a downstream step in the 
route does with data the route author never intended it to take from the message. Which sinks are reachable, and what 
the consequences are, depends entirely on what the route does after the unmarshal step. The camel-mail consumer already 
applied a header filter strategy on its own inbound path, so this was the parallel inbound path into the same component 
that the earlier hardening did not cover. The affected copy is reached only when headersInline is enabled, which is not 
the default: with the default setting the MIME headers are surfaced as attachments rather than as message headers, and 
are not affected. The behaviour dates back to the introduction of the data format in 2.17.0 and was present on every 
release line until this fix.



Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases 
stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are 
suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, leave headersInline at its default of 
false where the inline headers are not needed, since the copy is only reached when it is enabled. Where it must stay 
enabled, strip Camel-internal headers immediately after the unmarshal step, for example with removeHeaders(“Camel*”) 
placed before any processor or producer that reads control headers, and do not unmarshal MIME content from an untrusted 
sender into a route that dispatches on header values. As defence in depth, treat the header names of any MIME message 
arriving from outside the trust boundary as untrusted input.

Credit:

Atuin - Automated Vulnerability Discovery Engine, anciety of Tencent Xuanwu Lab (finder)
Andrea Cosentino (remediation developer)

References:

https://camel.apache.org/security/CVE-2026-59230.html
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-59230