Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.camel:camel-mail

5 known vulnerabilities (1 critical, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
4.23.0 (Oct 11, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2026-46584) can't be checked against versions
Newest unaffected release
4.23.0 (Oct 11, 2026), the latest release, not counting 1 advisory without comparable ranges
Advisories
5 · 1 critical, 2 medium, 1 low
Dependents
3
Releases
298 since 1.0.0 (Jul 2, 2007)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-85314
    Affects 4.0.0 to 4.18.4 (4.18.5 is outside it); 4.19.0 to 4.22.0 (4.22.1 is outside it)
  • CVE-2026-59230
    Affects 2.17.0 to 4.14.8 (4.14.9 is outside it); 4.15.0 to 4.18.3 (4.18.4 is outside it); 4.19.0 to 4.21.0 (4.22.0 is outside it)
  • CVE-2026-46584
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2026-33454
    Affects 3.0.0 to 4.14.5 (4.14.6 is outside it); 4.15.0 to 4.18.0 (4.18.1 is outside it)
  • CVE-2018-8041
    Affects 2.20.0 to 2.20.3 (2.20.4 is outside it); 2.21.0 to 2.21.1 (2.21.2 is outside it); 2.22.0 (2.22.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-85314Medium 6.5

    Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of…

    Affected: from 4.0.0, fixed in 4.18.5; from 4.19.0, fixed in 4.22.1.

    Fixed in 4.18.5 (released Oct 6, 2026, 13 days before disclosure) and 4.22.1 (released Sep 13, 2026, 36 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • CVE-2026-59230Medium 6.5

    Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when…

    Affected: from 2.17.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0; from 2.17.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0.

    Fixed in 4.14.9 (released Aug 9, 2026, 15 days before disclosure), 4.18.4 (released Aug 10, 2026, 14 days before disclosure) and 4.22.0 (released Aug 7, 2026, 17 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to…

    Affected: from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in r; from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0.

  • CVE-2026-33454Critical 9.4

    Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection…

    Affected: from 3.0.0, fixed in 4.14.6; from 4.15.0, fixed in 4.18.1; from 3.0.0, fixed in 4.14.6; from 4.15.0, fixed in 4.18.1.

    Fixed in 4.14.6 (released Apr 14, 2026, 13 days before disclosure) and 4.18.1 (released Mar 23, 2026, 35 days before disclosure).

    The latest release, 4.23.0, is not affected.

  • Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.

    Affected: from 2.20.0, fixed in 2.20.4; from 2.21.0, fixed in 2.21.2; from 2.22.0, fixed in 2.22.1.

    Fixed in 2.20.4 (released Jul 21, 2018, 58 days before disclosure), 2.21.2 (released Jul 16, 2018, 63 days before disclosure) and 2.22.1 (released Sep 2, 2018, 15 days before disclosure).

    The latest release, 4.23.0, is not affected.