Exploit for Deserialization of Untrusted Data in Apache Camel

camel-mina MinaConverter.toObjectInput Unsafe Deserialization...

CVE-2026-40473

A flaw was found in the camel-mina component of Apache Camel. This vulnerability allows a remote attacker to achieve arbitrary code execution by sending a specially crafted serialized Java object over the network to the MINA consumer port. The MinaConverter.toObjectInput type converter, used when...

org.apache.camel.springboot:camel-mina-starter (4.19.0) potentially affected by CVE-2026-40473 via org.apache.camel:camel-mina (4.19.0)

org.apache.camel:camel-mina MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-mina and may be impacted: - org.apache.camel.springboot:camel-mina-starter 4.19.0 Source cves: CVE-2026-40473 Source advisory:...

CVE-2026-40473

The camel-mina component's MinaConverter.toObjectInputIoBuffer type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput f...