CVE-2026-43866

camel-jms 伪造 DefaultExchangeHolder 过滤器绕过复现工具 CVE-2026-43866 本项目演示了 CVE-2026-43866 ，这是对 Apache Camel 的 camel-jms（以及 camel-sjms / JMS 系列）组件中 CVE-2026-40860 修复的一种绕过 。CVE-2026-40860 为传入的 JMS ObjectMessage 负载添加了反序列化后的类白名单（java.;javax.;org.apache.camel.;!）。但是...

EUVD-2026-41855

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

PT-2026-55885

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists in the Apache Camel JMS component where the JmsBinding.extractBodyFromJms function i...

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...