org.apache.camel.springboot:camel-sjms-starter (4.19.0), org.apache.camel.springboot:camel-sjms2-starter (4.19.0) +1 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-sjms (4.19.0)

org.apache.camel:camel-sjms MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-sjms and may be impacted: - org.apache.camel.springboot:camel-sjms-starter 4.19.0 - org.apache.camel.springboot:camel-sjms2-starter...

org.apache.camel.kafkaconnector:camel-sjms2-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-sjms2 (4.18.0) +12 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-sjms (>=4.15.0, <=4.18.1)

org.apache.camel:camel-sjms MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.15.0, =4.18.1 Source cves: CVE-2025-27636, CVE-2026-40453 Source advisory: GHSA-JG2M-9X48-3GVJhttps://vulners.com/github/GHSA-JG2M-9X...

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

CVE-2026-40860: Deserialization of Untrusted Data

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...