CVE-2026-85249

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata keys it carries. A crafted document could therefore set Exchange headers that the rest of the route depends on, including headers in the Camel namespace such as CamelFileName, which downstream components use to decide where content is written. The pattern is the same header-injection class as the consumer advisories published previously, reached here through parsed file content rather than through a protocol header. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Parsed document metadata is now filtered through a HeaderFilterStrategy before it is mapped onto the Exchange. A route that was reading a metadata-derived header the filter now blocks will see it missing. For deployments that cannot upgrade immediately, strip the Camel namespace after the Tika producer with removeHeaders("Camel*") before any component that acts on those headers.

• CWE-20

• https://camel.apache.org/security/CVE-2026-85249.htmlMitigation, Patch, Vendor Advisory
• https://github.com/apache/camel/pull/25819Issue Tracking, Patch
• https://github.com/apache/camel/pull/25940Issue Tracking, Patch
• https://github.com/apache/camel/pull/25942Issue Tracking, Patch
• https://issues.apache.org/jira/browse/CAMEL-24423Issue Tracking, Patch, Vendor Advisory

Published

Oct 19, 2026

Last Modified

Nov 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85242PlaywrightCapture contains a server-side request forgery (SS…6.9
• CVE-2026-85243Improper Validation of Integrity Check Value vulnerability i…5.9
• CVE-2026-85245Exposure of Data Element to Wrong Session vulnerability in A…5.9
• CVE-2026-85246Generation of Error Message Containing Sensitive Information…5.3
• CVE-2026-85247Improper Certificate Validation vulnerability in Apache Came…5.9
• CVE-2026-85248Concurrent Execution using Shared Resource with Improper Syn…5.9
• CVE-2026-8525Heap buffer overflow in ANGLE in Google Chrome on Mac prior …8.3
• CVE-2026-85250Improper Restriction of XML External Entity Reference vulner…7.5
• CVE-2026-85251Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2026-85254Improper Handling of Case Sensitivity vulnerability in Apach…6.5
• CVE-2026-85257Generation of Error Message Containing Sensitive Information…5.3
• CVE-2026-8526Out of bounds write in WebRTC in Google Chrome prior to 148.…8.8