org.apache.camel.karaf:camel-pqc (>=4.14.5, <=4.18.1), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.24.0, <=3.33.0) +2 more potentially affected by CVE-2026-40048 via org.apache.camel:camel-pqc (>=4.12.0, <=4.18.1)

org.apache.camel:camel-pqc MAVEN version =4.12.0, =4.14.5, =3.24.0, =3.24.0, =4.12.0, =4.18.1 Source cves: CVE-2026-40048 Source advisory: OSV:GHSA-V3VG-332R-MW99...

org.apache.camel.springboot:camel-pqc-starter (4.19.0) potentially affected by CVE-2026-40048 via org.apache.camel:camel-pqc (4.19.0)

org.apache.camel:camel-pqc MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-pqc and may be impacted: - org.apache.camel.springboot:camel-pqc-starter 4.19.0 Source cves: CVE-2026-40048 Source advisory:...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...