Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JmsBinding.extractBodyFromJms process when handling JMS ObjectMessages with the mapJmsMessage option enabled. An attacker can inject arbitrary Exchange state by publishing a crafted ObjectMessage...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

CVE-2026-43866: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

com.netas.jmeter:com.netas.jmeter.gradle.plugin (>=1.0.0-2.13, <=1.0.3-2.13), gradle.plugin.com.netas.jmeter:jmeter-gradle-plugin (>=1.0.0-2.13, <=1.0.3-2.13) +98 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (2.5.6)

org.springframework:spring-jms MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.netas.jmeter:com.netas.jmeter.gradle.plugin =1.0.0-2.13, =1.0.0-2.13, =1.0.5-2.13, =1.1.3, =0.1...

org.apache.camel:camel-amqp (>=2.21.4, <=2.21.5), org.apache.camel:camel-itest-jms2 (>=2.21.4, <=2.21.5) +47 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.20.release)

org.springframework:spring-jms MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-amqp =2.21.4, =2.21.4, =2.21.4, =2.21.4, =2.21.4, =5.3.5, =5.3.5,...

io.fabric8.fab.tests:fab-sample-camel-activemq-broker-share (>=1.1.0.beta1, <=1.1.0.cr2), io.fabric8.fab.tests:fab-sample-camel-activemq-share (>=1.1.0.beta1, <=1.1.0.cr2) +32 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.8.release)

org.springframework:spring-jms MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - io.fabric8.fab.tests:fab-sample-camel-activemq-broker-share =1.1.0.beta1, =1.1.0.beta1,...

org.apache.camel:camel-amqp (1.3.0), org.apache.camel:camel-mina (1.3.0) +69 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.6)

org.apache.mina:mina-core MAVEN version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.camel:camel-amqp 1.3.0 - org.apache.camel:camel-mina 1.3.0 -...

Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage

A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service JMS ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message paylo...

org.apache.camel.springboot:camel-activemq-starter (4.19.0), org.apache.camel.springboot:camel-activemq6-starter (4.19.0) +5 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-jms (4.19.0)

org.apache.camel:camel-jms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jms and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 -...

org.apache.camel.springboot:camel-activemq-starter (4.19.0), org.apache.camel.springboot:camel-activemq6-starter (4.19.0) +5 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-jms (4.19.0)

org.apache.camel:camel-jms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jms and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 -...

org.apache.camel.springboot:camel-activemq-starter (4.19.0), org.apache.camel.springboot:camel-activemq6-starter (4.19.0) +5 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-jms (4.19.0)

org.apache.camel:camel-jms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jms and may be impacted: - org.apache.camel.springboot:camel-activemq-starter 4.19.0 -...

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

CVE-2026-40860: Deserialization of Untrusted Data

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...