CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

CVE-2026-40859

Apache Camel's camel-netty-http and camel-vertx-http components are vulnerable to Remote Code Execution (RCE) via unsafe deserialization of untrusted data (CWE-502 ). The vulnerability exists in NettyHttpHelper and VertxHttpHelper because they use a raw java.io.ObjectInputStream without an Object...

CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

PT-2026-55882

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.19.9 Description The camel-vertx-http component deserializes HTTP response bodies with the...

CVE-2026-40859: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0.cr1, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=1.20.1) +2680 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=0.23.0, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1138 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

Path Equivalence

Overview io.quarkus:quarkus-vertx-http is a Cloud Native, Linux Container First framework for writing Java applications. Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP request...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.9.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.9.38, <=1.20.1) +1794 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.0.0.alpha1, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.alpha1, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.1, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375081...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1138 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-173750...

ai.pipestream.module:module-chunker (0.1.3), ai.pipestream.module:module-echo (0.1.3) +805 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0.cr1, =0.0.22, =0.7.28, =0.7.28, =0.7.25, =0.7.25, =0.7.28, =0.7.28, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.29 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375081...

ai.pipestream.module:module-embedder (0.3.0), ai.pipestream.module:quarkus-djl-serving-embeddings (0.3.0) +176 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (3.37.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.pipestream.module:module-embedder 0.3.0 - ai.pipestream.module:quarkus-djl-serving-embeddings...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.21.0, <=3.27.3)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=1.20.1) +2680 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=0.23.0, <=3.20.6)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.5 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +995 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.30.0, <=3.33.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.30.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.6, =0.1.10, =0.1.3, =0.1.3, =0.1.3, =0.1.5 - ai.pipestream:pipestream-engine 0.0.6 and more...

ai.pipestream:pipestream-server (>=0.7.23, <=0.7.24), ai.pipestream:pipestream-server-deployment (>=0.7.23, <=0.7.24) +272 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.34.0, <=3.34.6)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.24 - ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test 2.0.0 -...