CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage

A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service JMS ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message paylo...

org.apache.camel.kafkaconnector:camel-sjms-batch-kafka-connector (>=0.1.0 <=0.11.0), org.apache.camel.kafkaconnector:camel-sjms-kafka-connector (>=0.1.0 <=0.11.5) +21 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-sjms (>=3.0.0-M1 <=4.14.5)

org.apache.camel:camel-sjms MAVEN version =3.0.0-M1, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =4.10.3, =1.0.0, =2.2.0, =1.0.0-M1, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =3.19.0, =1.0.0, =3.2...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JmsBinding.extractBodyFromJms function in camel-jms and it's equivalents in camel-sjms that does not apply any ObjectInputFilter. An attacker can execute arbitrary code by sending a crafted JMS...

org.apache.camel.kafkaconnector:camel-sjms-batch-kafka-connector (>=0.1.0 <=0.11.0), org.apache.camel.kafkaconnector:camel-sjms-kafka-connector (>=0.1.0 <=0.11.5) +21 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-sjms (>=3.0.0-M1 <=4.14.6)

org.apache.camel:camel-sjms MAVEN version =3.0.0-M1, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =4.10.3, =1.0.0, =2.2.0, =1.0.0-M1, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =3.19.0, =1.0.0, =3.2...

org.apache.camel.kafkaconnector:camel-sjms-batch-kafka-connector (>=0.1.0 <=0.11.0), org.apache.camel.kafkaconnector:camel-sjms-kafka-connector (>=0.1.0 <=0.11.5) +19 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-sjms (>=3.0.0 <=4.14.5)

org.apache.camel:camel-sjms MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =4.10.3, =1.0.0, =2.2.0, =1.0.0-M1, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =3.19.0, =1.0.0, =3.27.3...