CVE-2026-85314
Description
A flaw was found in the Apache Camel Mail component. A remote attacker can exploit this vulnerability by sending a specially crafted multipart email message containing arbitrary mail configuration headers. Because these headers bypass filtering during message processing, the attacker can influence how downstream mail services connect and route messages, potentially leading to unauthorized tampering or redirection of outgoing email communications.
Statement
This vulnerability is rated as Moderate because exploitation requires specific route architectures where untrusted multipart messages are unmarshalled and subsequently passed to downstream mail endpoints without sanitization. While remote attackers can inject SMTP configuration properties without authentication, the scope of impact is confined to diverting or tampering with outbound email rather than compromising the underlying host system.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
