CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

CVE-2026-43866

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproducer CVE-2026-43866 This project demonstrates CVE-2026-43866 , a bypass of the CVE-2026-40860 fix in Apache Camel's camel-jms and camel-sjms / JMS-family components. CVE-2026-40860 added a post-deserialization class allow-list...

CVE-2026-40453

Case-Variant Camel Header Injection Reproducer CVE-2026-40453 This project demonstrates CVE-2026-40453 — an incomplete fix for CVE-2025-27636. The 2025 fix added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names e.g. CAmelExecCommandExecutable are filtered alongside t...

camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of untrusted data

A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machin...

CVE-2026-42527

A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machin...

camel-jms Java Framework Extract Body From Jms

The vulnerability of the extractBodyFromJms function in the camel-jms Java framework by Apache Camel is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890710...

org.apache.activemq:apache-activemq (>=6.2.0, <=6.2.8), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=4.14.0, <=4.14.5) +31 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.14.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =4.14.0, =6.2.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 - org.apache.camel.quarkus:camel-quarkus-integration-te...

GHSA-F755-XP6R-8Q84 Apache Camel JMS deserialization filter bypass

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

io.kaoto.forage:camel-jbang-plugin-forage (>=1.1, <=1.2), io.kaoto.forage:forage-catalog (>=1.1, <=1.2) +43 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.18.0, <=4.18.2)

org.apache.camel:camel-jms MAVEN version =4.18.0, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.2 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector 4.18.0 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-source-kafka-connector 4.18.0 -...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.activemq:apache-activemq (>=6.2.0, <=6.2.8), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=4.14.0, <=4.14.5) +31 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.14.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =4.14.0, =6.2.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 - org.apache.camel.quarkus:camel-quarkus-integration-te...

org.apache.activemq:apache-activemq (>=6.2.0, <=6.2.8), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=4.14.0, <=4.14.5) +31 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.14.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =4.14.0, =6.2.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 - org.apache.camel.quarkus:camel-quarkus-integration-te...

CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-42527

Apache Camel is vulnerable to a deserialization of untrusted data (CWE-502) issue due to a permissive default ObjectInputFilter. The filter pattern java.**;javax.**;org.apache.camel.**;!* admits java.net.URL and java.net.InetAddress. When deserializing a HashMap containing java.net.URL keys, the ...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

org.apache.activemq:apache-activemq (>=6.2.0, <=6.2.8), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=4.14.0, <=4.14.5) +31 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.14.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =4.14.0, =6.2.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 - org.apache.camel.quarkus:camel-quarkus-integration-te...

io.kaoto.forage:camel-jbang-plugin-forage (>=1.1, <=1.2), io.kaoto.forage:forage-catalog (>=1.1, <=1.2) +43 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.18.0, <=4.18.2)

org.apache.camel:camel-jms MAVEN version =4.18.0, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.2 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector 4.18.0 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-source-kafka-connector 4.18.0 -...

CVE-2026-43866: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...