CVE-2026-40048

camel-pqc FileBasedKeyLifecycleManager 不安全反序列化复现工具 CVE-2026-40048 该项目演示了 Apache Camel 的 camel-pqc 组件中的 Java 反序列化漏洞 ，追踪编号为 CVE-2026-40048 。FileBasedKeyLifecycleManager 从配置的密钥目录中读取 .key 文件，使用原始的 ObjectInputStream 且未设置 ObjectInputFilter，因此能够写入该目录的攻击者可实现 远程代码执行 。...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...