Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JmsBinding.extractBodyFromJms process when handling JMS ObjectMessages with the mapJmsMessage option enabled. An attacker can inject arbitrary Exchange state by publishing a crafted ObjectMessage...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.7)

org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875276...

org.apache.camel.karaf:camel-activemq (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-activemq (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=4.15.0, <=4.18.2)

org.apache.camel:camel-activemq MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875276...

org.apache.camel.quarkus:camel-quarkus-activemq (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-activemq-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=4.19.0, <=4.20.0)

org.apache.camel:camel-activemq MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875276...

org.apache.camel.quarkus:camel-quarkus-activemq (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-activemq-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-activemq (>=4.19.0, <=4.20.0)

org.apache.camel:camel-activemq MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

org.apache.camel.karaf:camel-activemq (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-activemq (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-activemq (>=4.15.0, <=4.18.2)

org.apache.camel:camel-activemq MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

org.apache.camel.karaf:camel-activemq (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-activemq (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=4.15.0, <=4.18.2)

org.apache.camel:camel-activemq MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-43866 Source advisory: OSV:GHSA-F755-XP6R-8Q84...

org.apache.camel.quarkus:camel-quarkus-activemq (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-activemq-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=4.19.0, <=4.20.0)

org.apache.camel:camel-activemq MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43866 Source advisory: OSV:GHSA-F755-XP6R-8Q84...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.7)

org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-43866 Source advisory: MEND:CVE-2026-43866...

org.apache.camel.quarkus:camel-quarkus-activemq (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-activemq-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=4.19.0, <=4.20.0)

org.apache.camel:camel-activemq MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43866 Source advisory: MEND:CVE-2026-43866...

CVE-2026-43866

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

org.apache.camel.karaf:camel-activemq (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-activemq (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-activemq (>=4.15.0, <=4.18.2)

org.apache.camel:camel-activemq MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-43866 Source advisory: MEND:CVE-2026-43866...

CVE-2026-43866: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage

A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service JMS ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message paylo...

org.apache.camel.springboot:camel-activemq-starter (4.19.0), org.apache.camel.springboot:camel-activemq6-starter (4.19.0) +5 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-jms (4.19.0)

org.apache.camel:camel-jms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jms and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 -...

org.apache.camel.springboot:camel-activemq-starter (4.19.0), org.apache.camel.springboot:camel-activemq6-starter (4.19.0) +5 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-jms (4.19.0)

org.apache.camel:camel-jms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jms and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 -...

org.apache.camel.springboot:camel-activemq-starter (4.19.0) potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (4.19.0)

org.apache.camel:camel-activemq MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-activemq and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 Source cves: CVE-2026-40860 Source...

org.apache.camel.springboot:camel-activemq-starter (4.19.0) potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (4.19.0)

org.apache.camel:camel-activemq MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-activemq and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 Source cves: CVE-2026-40860 Source...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.6)

org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-40860 Source advisory: OSV:GHSA-M5VH-3FW5-5WGH...

org.apache.camel.karaf:camel-activemq (4.18.1), org.apache.camel.quarkus:camel-quarkus-activemq (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (>=4.15.0, <=4.18.1)

org.apache.camel:camel-activemq MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40860 Source advisory: OSV:GHSA-M5VH-3FW5-5WGH...