Message header injection in Apache Camel camel-mail component (CVE-2026-33454)

The Camel-Mail component's custom header filter strategy (MailHeaderFilterStrategy) filters only the outbound direction and leaves the inbound direction unconfigured, allowing Camel-prefixed MIME headers from incoming mail to pass unfiltered into the Exchange. An attacker able to deliver email to a mailbox monitored by a camel-mail consumer can inject Camel-specific headers that alter route behaviour in downstream components such as camel-bean, camel-exec, or camel-sql. Affected versions: - from 3.0.0 before 4.14.6 - from 4.15.0 before 4.18.1 We recommend updating to: 4.14.6, 4.18.1, 4.19.0. CVSS 9.4 · our assessment: act_now Reference: https://camel.apache.org/security/CVE-2026-33454.html Details: https://vuln.today/cve/CVE-2026-33454