CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

CVE-2026-43866

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproducer CVE-2026-43866 This project demonstrates CVE-2026-43866 , a bypass of the CVE-2026-40860 fix in Apache Camel's camel-jms and camel-sjms / JMS-family components. CVE-2026-40860 added a post-deserialization class allow-list...

CVE-2026-40453

Case-Variant Camel Header Injection Reproducer CVE-2026-40453 This project demonstrates CVE-2026-40453 — an incomplete fix for CVE-2025-27636. The 2025 fix added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names e.g. CAmelExecCommandExecutable are filtered alongside t...

camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of untrusted data

A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machin...

CVE-2026-42527

A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machin...

camel-jms Java Framework Extract Body From Jms

The vulnerability of the extractBodyFromJms function in the camel-jms Java framework by Apache Camel is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +81 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-jms (>=3.0.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =1.0, =hyte-mq-4.3.7.hyte-43072, =hyte-mq-4.3.7.hyte-43072, =4.4.11.hyte-26354 and more Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875272...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875272...

org.apache.camel.kafkaconnector:camel-amqp-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=3.20.3, <=4.14.5) +6 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-amqp (>=3.0.0, <=4.14.7)

org.apache.camel:camel-amqp MAVEN version =3.0.0, =0.1.0, =3.20.3, =3.20.3, =4.7.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =3.0.0, =4.14.7 Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875275...

org.apache.activemq:apache-activemq (>=6.2.0, <=6.2.8), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=4.14.0, <=4.14.5) +31 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.14.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =4.14.0, =6.2.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 - org.apache.camel.quarkus:camel-quarkus-integration-te...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890710...

GHSA-F755-XP6R-8Q84 Apache Camel JMS deserialization filter bypass

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.activemq:apache-activemq (>=6.2.0, <=6.2.8), org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector (>=4.14.0, <=4.14.5) +31 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.14.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =4.14.0, =6.2.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 - org.apache.camel.quarkus:camel-quarkus-integration-te...

io.kaoto.forage:camel-jbang-plugin-forage (>=1.1, <=1.2), io.kaoto.forage:forage-catalog (>=1.1, <=1.2) +43 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.18.0, <=4.18.2)

org.apache.camel:camel-jms MAVEN version =4.18.0, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.2 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector 4.18.0 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-source-kafka-connector 4.18.0 -...

ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +81 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-jms (>=3.0.0, <=4.14.7)

org.apache.camel:camel-jms MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =1.0, =hyte-mq-4.3.7.hyte-43072, =hyte-mq-4.3.7.hyte-43072, =4.4.11.hyte-26354 and more Source cves: CVE-2026-43866 Source advisory: OSV:GHSA-F755-XP6R-8Q84...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-40860 +1 more via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-40860, CVE-2026-43866 Source advisory: GHSA-F755-XP6R-8Q84...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

io.kaoto.forage:forage-jms (1.5.0), io.kaoto.forage:forage-jms-artemis (1.5.0) +30 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-jms (>=4.19.0, <=4.20.0)

org.apache.camel:camel-jms MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.36.0 and more Source cves: CVE-2026-43866 Source advisory: OSV:GHSA-F755-XP6R-8Q84...

io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.2), io.kaoto.forage:forage-catalog (>=1.0, <=1.2) +43 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-jms (>=4.15.0, <=4.18.2)

org.apache.camel:camel-jms MAVEN version =4.15.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0, =1.2 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-sink-kafka-connector 4.18.0 - org.apache.camel.kafkaconnector:camel-jms-amqp-10-source-kafka-connector 4.18.0 -...