The Camel‑Mail component in Apache Camel allows an attacker to inject custom MIME headers, which are not filtered on inbound traffic due to a missing input filter configuration. This may cause downstream components such as camel-bean, camel-exec, or camel-sql to interpret these headers maliciously, enabling arbitrary code execution. The vulnerability involves both CWE‑1173 (Header Injection) and CWE‑502 (Deserialization For Remote Code Execution).

Apache Camel versions 3.0.0 through 4.14.5 and 4.15.0 through 4.18.0 are affected. Versions before 4.14.6, before 4.18.1, and before 4.19.0 contain the vulnerable inbound header filter logic.

The CVSS score of 9.4 indicates critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is sending a malicious email to a mailbox monitored by a Camel mail consumer, allowing the attacker to inject the harmful header and gain control. Successful exploitation would compromise confidentiality, integrity, and availability by enabling arbitrary code execution within the Camel application’s runtime environment.