CVE-2026-40048

The camel-pqc component in Apache Camel is vulnerable to unsafe deserialization of untrusted data in the FileBasedKeyLifecycleManager class. The component reads .key files using a raw java.io.ObjectInputStream without any ObjectInputFilter or class-loading restrictions. Because the cast to java.s...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...