# org.apache.camel:camel-mail (Maven) vulnerabilities 5 known vulnerabilities (1 critical, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.23.0 (Oct 11, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2026-46584) can't be checked against versions - Newest unaffected release: 4.23.0 (Oct 11, 2026), the latest release, not counting 1 advisory without comparable ranges - Dependents: 3 - Releases: 298 since 1.0.0 (Jul 2, 2007) - Registry: https://central.sonatype.com/artifact/org.apache.camel/camel-mail - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-85314: 4.0.0 to 4.18.4 (4.18.5 is outside it); 4.19.0 to 4.22.0 (4.22.1 is outside it) - CVE-2026-59230: 2.17.0 to 4.14.8 (4.14.9 is outside it); 4.15.0 to 4.18.3 (4.18.4 is outside it); 4.19.0 to 4.21.0 (4.22.0 is outside it) - CVE-2026-46584: its ranges can't be placed on these versions - CVE-2026-33454: 3.0.0 to 4.14.5 (4.14.6 is outside it); 4.15.0 to 4.18.0 (4.18.1 is outside it) - CVE-2018-8041: 2.20.0 to 2.20.3 (2.20.4 is outside it); 2.21.0 to 2.21.1 (2.21.2 is outside it); 2.22.0 (2.22.1 is outside it) ## Advisories (5) ### [CVE-2026-85314](https://cve.now/CVE-2026-85314): Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of… - Severity: Medium 6.5 - Published: Oct 19, 2026 - Affected: from 4.0.0, fixed in 4.18.5; from 4.19.0, fixed in 4.22.1. - Fixed in 4.18.5 (released Oct 6, 2026, 13 days before disclosure) and 4.22.1 (released Sep 13, 2026, 36 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2026-59230](https://cve.now/CVE-2026-59230): Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when… - Severity: Medium 6.5 - Published: Aug 24, 2026 - Affected: from 2.17.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0; from 2.17.0, fixed in 4.14.9; from 4.15.0, fixed in 4.18.4; from 4.19.0, fixed in 4.22.0. - Fixed in 4.14.9 (released Aug 9, 2026, 15 days before disclosure), 4.18.4 (released Aug 10, 2026, 14 days before disclosure) and 4.22.0 (released Aug 7, 2026, 17 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2026-46584](https://cve.now/CVE-2026-46584): Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to… - Severity: Low 3.7 - Published: Jul 6, 2026 - Affected: from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in r; from 4.0.0, fixed in 4.14.8; from 4.15.0, fixed in 4.18.3; from 4.19.0, fixed in 4.21.0. ### [CVE-2026-33454](https://cve.now/CVE-2026-33454): Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection… - Severity: Critical 9.4 - Published: Apr 27, 2026 - Affected: from 3.0.0, fixed in 4.14.6; from 4.15.0, fixed in 4.18.1; from 3.0.0, fixed in 4.14.6; from 4.15.0, fixed in 4.18.1. - Fixed in 4.14.6 (released Apr 14, 2026, 13 days before disclosure) and 4.18.1 (released Mar 23, 2026, 35 days before disclosure). - The latest release, 4.23.0, is not affected. ### [CVE-2018-8041](https://cve.now/CVE-2018-8041): Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal. - Severity: Unrated - Published: Sep 17, 2018 - Affected: from 2.20.0, fixed in 2.20.4; from 2.21.0, fixed in 2.21.2; from 2.22.0, fixed in 2.22.1. - Fixed in 2.20.4 (released Jul 21, 2018, 58 days before disclosure), 2.21.2 (released Jul 16, 2018, 63 days before disclosure) and 2.22.1 (released Sep 2, 2018, 15 days before disclosure). - The latest release, 4.23.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.camel:camel-mail Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.