PT-2026-35384 · Apache+1 · Apache Camel+2

Hyunwoo Kim · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-33454

X.com · Cvenew

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CVE-2026-33454 The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filt… https://t.co/aFcj2mALO4

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-33454

GHSA-2VQF-X7G4-7C2G

Affected Products

Apache Camel

Camel

Org.Apache.Camel:Camel-Mail

References · 21

• https://camel.apache.org/security/CVE-2026-33454.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2vqf-x7g4-7c2g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33454 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/05cffa5ec05ff2ec3c50a77825625da6e426e7a8 · Note
• https://github.com/apache/camel/pull/22151 · Note
• https://github.com/apache/camel/commit/540d48e1cb5e492bd1c74bfc5a6e929fcf24fe3b · Note
• https://github.com/apache/camel/pull/22148 · Note
• https://github.com/apache/camel/pull/22146 · Note
• https://github.com/apache/camel/pull/22150 · Note
• https://github.com/apache/camel/pull/22147 · Note
• https://github.com/apache/camel/pull/22149 · Note
• https://github.com/apache/camel/commit/5c20de8f047de725e0b32a874cdb5108c3e46558 · Note
• https://github.com/apache/camel/commit/0307dd4709a8136eba3206701004bcb528bc47fd · Note
• https://github.com/apache/camel/commit/3926ab2b7745e36da2cd8e0dc019018bc415aff9 · Note