CVE-2026-43866

Summary: A deserialization bypass affects Apache Camel JMS components (camel-jms, camel-sjms, and JMS-family such as camel-amqp/activemq) where ObjectMessage payloads are deserialized via ObjectMessage.getObject() when mapJmsMessage is enabled. Despite a post-deserialization class check intended ...

EUVD-2026-41855

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...