PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33454 Apache Software Foundation CVE debrief

CVE-2026-33454 is a critical vulnerability in Apache Camel's Camel-Mail component. The custom header filter strategy used by the component only filters the 'out' direction, leaving the 'in' direction unfiltered. This allows an attacker to inject Camel-specific headers, potentially altering the behavior of downstream Camel components. The vulnerability affects Apache Camel versions from 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0 or apply patches to mitigate the issue.

Vendor
Apache Software Foundation
Product
Apache Camel
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-27
Original CVE updated
2026-07-15
Advisory published
2026-04-27
Advisory updated
2026-07-15

Who should care

Apache Camel users, administrators, and security teams should be aware of this vulnerability. Affected versions of Apache Camel are widely used in various industries, making this a critical issue to address. Security teams should prioritize patching or upgrading to mitigate potential attacks.

Technical summary

The Camel-Mail component in Apache Camel is vulnerable to message header injection attacks due to a flawed custom header filter strategy. The strategy only filters the 'out' direction, leaving the 'in' direction unfiltered. This allows an attacker to inject Camel-specific headers, potentially altering the behavior of downstream Camel components, such as camel-bean, camel-exec, or camel-sql. The vulnerability is rated as Critical with a CVSS score of 9.4.

Defensive priority

High priority should be given to patching or upgrading affected Apache Camel instances. Security teams should work closely with development teams to ensure timely mitigation of this vulnerability.

Recommended defensive actions

  • Upgrade to Apache Camel version 4.19.0 or later
  • Apply patches for affected versions (4.14.6 or 4.18.1)
  • Review and update Camel-Mail component configurations
  • Monitor for suspicious activity and implement additional security measures
  • Perform thorough vulnerability assessments and penetration testing

Evidence notes

The CVE-2026-33454 vulnerability was publicly disclosed on April 27, 2026, and has since been modified on June 27, 2026. The vulnerability affects multiple versions of Apache Camel, and users are advised to upgrade or apply patches to mitigate the issue. The CVSS score of 9.4 indicates a Critical severity level.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33454 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33454

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33454 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33454

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://camel.apache.org/security/CVE-2026-33454.html

    [email protected] - Vendor Advisory

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:17668

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:19835

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-33454

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33454.json

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.