CVE-2026-43866

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproducer CVE-2026-43866 This project demonstrates CVE-2026-43866 , a bypass of the CVE-2026-40860 fix in Apache Camel's camel-jms and camel-sjms / JMS-family components. CVE-2026-40860 added a post-deserialization class allow-list...

Apache Camel JMS deserialization filter bypass

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

org.apache.camel.karaf:camel-activemq6 (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-activemq6 (>=3.30.0, <=3.33.1) +3 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-activemq6 (>=4.15.0, <=4.18.2)

org.apache.camel:camel-activemq6 MAVEN version =4.15.0, =4.18.1, =3.30.0, =3.30.0, =3.30.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

org.apache.camel.kafkaconnector:camel-sjms2-kafka-connector (>=0.1.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-sjms2 (>=0.3.0, <=4.14.5) +9 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-sjms2 (>=3.0.0, <=4.14.7)

org.apache.camel:camel-sjms2 MAVEN version =3.0.0, =0.1.0, =0.3.0, =0.1.0, =4.7.0, =1.0.0-m5, =1.0.0-m1, =2.2.0, =2.2.0, =1.0.0-m1, =1.0.0-m1, =3.0.0, =4.14.7 Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

org.apache.camel.kafkaconnector:camel-sjms2-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-sjms2 (4.18.0) +6 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-sjms2 (>=4.15.0, <=4.18.2)

org.apache.camel:camel-sjms2 MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

org.apache.camel.kafkaconnector:camel-sjms-batch-kafka-connector (>=0.1.0, <=0.11.0), org.apache.camel.kafkaconnector:camel-sjms-kafka-connector (>=0.1.0, <=0.11.5) +19 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-sjms (>=3.0.0, <=4.14.7)

org.apache.camel:camel-sjms MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =4.7.0, =1.0.0-m5, =2.2.0, =1.0.0-m1, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =3.17.0, =1.0.0-m1, =...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.7)

org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

EUVD-2026-41855

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

PT-2026-55885

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists in the Apache Camel JMS component where the JmsBinding.extractBodyFromJms function i...

org.apache.camel.kafkaconnector:camel-sjms2-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-sjms2 (4.18.0) +6 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-sjms2 (>=4.15.0, <=4.18.1)

org.apache.camel:camel-sjms2 MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40860 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321538...

org.apache.camel.springboot:camel-sjms2-starter (4.19.0) potentially affected by CVE-2026-40860 via org.apache.camel:camel-sjms2 (4.19.0)

org.apache.camel:camel-sjms2 MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-sjms2 and may be impacted: - org.apache.camel.springboot:camel-sjms2-starter 4.19.0 Source cves: CVE-2026-40860 Source advisory:...

org.apache.camel.springboot:camel-sjms2-starter (4.19.0) potentially affected by CVE-2026-40860 via org.apache.camel:camel-sjms2 (4.19.0)

org.apache.camel:camel-sjms2 MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-sjms2 and may be impacted: - org.apache.camel.springboot:camel-sjms2-starter 4.19.0 Source cves: CVE-2026-40860 Source advisory:...

org.apache.camel.springboot:camel-activemq-starter (4.19.0) potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (4.19.0)

org.apache.camel:camel-activemq MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-activemq and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 Source cves: CVE-2026-40860 Source...

org.apache.camel.springboot:camel-amqp-starter (4.19.0) potentially affected by CVE-2026-40860 via org.apache.camel:camel-amqp (4.19.0)

org.apache.camel:camel-amqp MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-amqp and may be impacted: - org.apache.camel.springboot:camel-amqp-starter 4.19.0 Source cves: CVE-2026-40860 Source advisory:...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +81 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-jms (>=3.0.0, <=4.14.6)

org.apache.camel:camel-jms MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =1.0, =hyte-mq-4.3.7.hyte-43072, =hyte-mq-4.3.7.hyte-43072, =4.4.11.hyte-26354 and more Source cves: CVE-2026-40860 Source advisory: OSV:GHSA-M5VH-3FW5-5WGH...

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...