# CVE-2026-85314: Apache Camel Mail component header injection in MimeMultipart

Source: https://junglewise.ai/threats/cve-2026-85314-improper-input-validation-vulnerability-in-apache-camel-mail  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-85314 · Severity: medium · CVSS 6.5 · Published 2026-10-19

Apache Camel is an integration framework that processes message data across systems. A flaw in its Mail component allows external attackers to inject mail.smtp headers into messages during parsing, which can alter how downstream mail producers connect and send data. This could lead to unauthorized mail routing, credential exposure, or other mail-related attacks in deployments that apply the prior CVE-2026-46584 fix but remain vulnerable via this incomplete remediation.

Technologies: [Apache Camel](https://junglewise.ai/threats/technologies/camel). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-85314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85314 being exploited in the wild.

**How severe is CVE-2026-85314?** Medium severity, with a CVSS score of 6.5, published 19 October 2026.

**Which products and versions are affected?** Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.

**Is there a fix for CVE-2026-85314?** Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: For deployments that cannot upgrade immediately, strip the mail.smtp namespace after the MimeMultipart data format with removeHeaders("mail.smtp*") before any mail producer. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85314 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85314?** Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.18.5, 4.22.1, 4.23.0

For deployments that cannot upgrade immediately, strip the mail.smtp namespace after the MimeMultipart data format with removeHeaders("mail.smtp*") before any mail producer.

## Technical details

The MimeMultipart data format in Apache Camel unmarshals multipart messages and maps mail.smtp headers onto the Exchange without applying the header filter that consumer filters use. Because these headers sit outside the Camel namespace that consumer filters block, a crafted external message can inject them; the mail.smtp namespace influences downstream mail producer connections. This is an incomplete fix of CVE-2026-46584 rather than a new defect class. The vulnerability requires network access to send a malformed multipart message.

## Affected products

- Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1

## Timeline

- 2026-10-15: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://camel.apache.org/security/CVE-2026-85314.html](https://camel.apache.org/security/CVE-2026-85314.html)

## Related threats

- [Apache Camel SSRF in A2A webhook validator](https://junglewise.ai/threats/cve-2026-71569-server-side-request-forgery-ssrf-vulnerability-in-apache-camel)
- [Apache Camel OAuth component cache containing sensitive information](https://junglewise.ai/threats/cve-2026-94386-use-of-cache-containing-sensitive-information-vulnerability-in)
- [Apache Camel Saxon component XXE in XQuery evaluation](https://junglewise.ai/threats/cve-2026-90885-improper-restriction-of-xml-external-entity-reference)
- [Apache Camel AWS2-S3 expression language injection in key handling](https://junglewise.ai/threats/cve-2026-95664-improper-neutralization-of-special-elements-used-in-an-expression)
- [Apache Camel Keycloak security policy token expiration bypass](https://junglewise.ai/threats/cve-2026-95663-insufficient-session-expiration-vulnerability-in-apache-camel)