PT-2026-35384 · Apache · Camel-Mail

Hyunwoo Kim · CVE-2026-33454 · Published 2026-04-27 · Updated 2026-07-11

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 4.19.0

Description A flaw in the Camel-Mail component allows an attacker to perform message header injection by sending a specially crafted email to a mailbox monitored by a Camel application. Due to a missing inbound filter in the MailHeaderFilterStrategy, malicious headers are not properly filtered, which can alter the behavior of downstream components. This issue involves the setOutFilterStartsWith() function and deficiencies in the deserialization mechanism, potentially leading to remote code execution (RCE), where an attacker can execute arbitrary code on the system.

Recommendations Update to version 4.19.0 or the latest supported LTS release.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-1173

Related Identifiers

BDU:2026-09302

CVE-2026-33454

GHSA-2VQF-X7G4-7C2G

Affected Products

Camel-Mail

References · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33454.json · Exploit
• 🔥 https://github.com/oscerd/CVE-2026-33454 · Exploit
• https://camel.apache.org/security/CVE-2026-33454.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2vqf-x7g4-7c2g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33454 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:17668 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09302 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33454 · Security Note
• https://access.redhat.com/errata/RHSA-2026:19835 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/22147 · Note
• https://github.com/apache/camel/pull/22146 · Note
• https://github.com/apache/camel/pull/22148 · Note
• https://github.com/apache/camel/commit/05cffa5ec05ff2ec3c50a77825625da6e426e7a8 · Note
• https://github.com/apache/camel/pull/22149 · Note