Junglewise Threat Intelligence

CVE-2026-33454: Apache Camel header injection in Camel-Mail component

CVE-2026-33454 · Severity: critical · CVSS 9.4 · Published 2026-04-27

Technologies: Red Hat build of Apache Camel for Quarkus, Apache Camel, Red Hat build of Apache Camel for Spring Boot. Vendors: Red Hat, Apache.

Executive brief

Apache Camel is a popular integration framework used to connect different software applications. A vulnerability in its email-handling component allows attackers to send specially crafted emails that inject hidden commands into the system. This can allow an attacker to manipulate how the application processes data, potentially leading to unauthorized data access or execution of unintended actions.

Technical details

The Camel-Mail component (camel-mail) is vulnerable to message header injection due to improper configuration in the MailHeaderFilterStrategy class. While the component filters outgoing headers, it fails to invoke setInFilterStartsWith for incoming messages (IMAP/POP3). This allows an attacker to deliver an email containing Camel-prefixed MIME headers that are mapped unfiltered into the Camel Exchange. Downstream components such as camel-bean, camel-exec, or camel-sql may then interpret these injected headers, leading to altered route behavior or remote code execution. This follows a similar pattern to previous header injection vulnerabilities in camel-undertow and other components. Fixes are available in versions 4.14.6, 4.18.1, and 4.19.0.

Affected products

  • Apache Camel 3.0.0 before 4.14.6, 4.15.0 before 4.18.1
  • Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14

Timeline

  • 2026-04-27: advisory: Initial publication of CVE-2026-33454
  • 2026-05-14: patched: Red Hat release of patched Camel for Spring Boot

References

Related threats