CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

CVE-2026-43866: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage

A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service JMS ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message paylo...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JmsBinding.extractBodyFromJms function in camel-jms and it's equivalents in camel-sjms that does not apply any ObjectInputFilter. An attacker can execute arbitrary code by sending a crafted JMS...

org.apache.camel.kafkaconnector:camel-sjms2-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-sjms2 (4.18.0) +12 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-sjms (>=4.15.0, <=4.18.1)

org.apache.camel:camel-sjms MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: OSV:GHSA-JG2M-9X48-3GVJ...

org.apache.camel.springboot:camel-sjms-starter (4.19.0), org.apache.camel.springboot:camel-sjms2-starter (4.19.0) +1 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-sjms (4.19.0)

org.apache.camel:camel-sjms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-sjms and may be impacted: - org.apache.camel.springboot:camel-sjms-starter 4.19.0 - org.apache.camel.springboot:camel-sjms2-starter...

org.apache.camel.kafkaconnector:camel-sjms-batch-kafka-connector (>=0.1.0, <=0.11.0), org.apache.camel.kafkaconnector:camel-sjms-kafka-connector (>=0.1.0, <=0.11.5) +19 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-sjms (>=3.0.0, <=4.14.5)

org.apache.camel:camel-sjms MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =4.7.0, =1.0.0-m5, =2.2.0, =1.0.0-m1, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =3.17.0, =1.0.0-m1, =...

org.apache.camel.kafkaconnector:camel-sjms2-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-sjms2 (4.18.0) +12 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-sjms (>=4.15.0, <=4.18.1)

org.apache.camel:camel-sjms MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.15.0, =4.18.1 Source cves: CVE-2025-27636, CVE-2026-40453 Source advisory: GHSA-JG2M-9X48-3GVJhttps://vulners.com/github/GHSA-JG2M-9X...

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

CVE-2026-40860: Deserialization of Untrusted Data

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...