CVE-2026-43866

camel-jms 伪造 DefaultExchangeHolder 过滤器绕过复现工具 CVE-2026-43866 本项目演示了 CVE-2026-43866 ，这是对 Apache Camel 的 camel-jms（以及 camel-sjms / JMS 系列）组件中 CVE-2026-40860 修复的一种绕过 。CVE-2026-40860 为传入的 JMS ObjectMessage 负载添加了反序列化后的类白名单（java.;javax.;org.apache.camel.;!）。但是...

GHSA-F755-XP6R-8Q84 Apache Camel JMS deserialization filter bypass

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...