https://seclists.org/oss-sec/2026/q3/561: CVE-2026-59230: Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Q: Which deployments are affected?

Deployments using the camel-mail MimeMultipart data format are affected when unmarshalling MIME multipart messages with headersInline set to true. Affected releases are 2.17.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0.

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to influence the MIME multipart message being unmarshalled. They can supply a MIME header whose name falls within Camel's internal header namespace, causing it to be set on the Exchange.

Q: Are all incoming MIME headers copied onto the Camel message?

No. Message-ID, MIME-Version, and Content-Type are generated as standard headers and are excluded from the copied incoming headers. Other MIME headers are copied without a HeaderFilterStrategy when headersInline is enabled.

Q: What is the security impact of setting a Camel-internal header?

Camel components read control headers from the internal namespace to override configured behavior. An attacker-controlled MIME header in that namespace can therefore alter component behavior on the Exchange.

Published Aug 24, 2026

Updated

Affected Software

2 affected components

Apache Camel-Mail>2.17.0<4.14.9, >4.15.0<4.18.4, >4.19.0<4.22.0

Apache Apache Camel>2.17.0<4.14.9, >4.15.0<4.18.4, >4.19.0<4.22.0

Frequently Asked Questions

Which deployments are affected?

Deployments using the camel-mail MimeMultipart data format are affected when unmarshalling MIME multipart messages with headersInline set to true. Affected releases are 2.17.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0.

What does an attacker need to exploit this issue?

An attacker needs to be able to influence the MIME multipart message being unmarshalled. They can supply a MIME header whose name falls within Camel's internal header namespace, causing it to be set on the Exchange.

Are all incoming MIME headers copied onto the Camel message?

No. Message-ID, MIME-Version, and Content-Type are generated as standard headers and are excluded from the copied incoming headers. Other MIME headers are copied without a HeaderFilterStrategy when headersInline is enabled.

What is the security impact of setting a Camel-internal header?

Camel components read control headers from the internal namespace to override configured behavior. An attacker-controlled MIME header in that namespace can therefore alter component behavior on the Exchange.