CVE-2026-43866

Riproduttore del bypass del filtro di DefaultExchangeHolder forgiato camel-jms CVE-2026-43866 Questo progetto dimostra CVE-2026-43866 , un bypass della correzione di CVE-2026-40860 nei componenti camel-jms e camel-sjms / famiglia JMS di Apache Camel. CVE-2026-40860 ha aggiunto una allow-list di...

CVE-2026-40860

camel-jms Riproduttore di deserializzazione non sicura di JMS ObjectMessage CVE-2026-40860 Questo progetto dimostra una vulnerabilità di deserializzazione Java nel componente camel-jms di Apache Camel e, transitivamente, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6,...

ActiveMQ_CVE-2015-5254

ActiveMQ-Deserialisierung CVE-2015-5254 Beschreibung der Schwachstelle: In Apache ActiveMQ-Versionen vor 5.13.0 besteht eine Sicherheitsanfälligkeit, da die Software nicht einschränkt, welche Klassen im Broker serialisiert werden können. Ein entfernter Angreifer kann diese Schwachstelle ausnutzen...

Exploitation-de-la-vuln-rabilit-CVE-2015-5254-

Ausnutzung-der-Schwachstelle-CVE-2015-5254- Die Schwachstelle CVE-2015-5254 ist ein Sicherheitsfehler in Apache ActiveMQ, einem weit verbreiteten Open-Source-Nachrichtenserver für die Kommunikation zwischen Anwendungen. Diese Schwachstelle betrifft ActiveMQ-Versionen bis 5.13.0 und liegt im Fehle...

CVE-2026-66909

A flaw was found in Apache CXF. The Java Message Service JMS transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service's JMS destination. This vulnerability could lead ...

camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection

A flaw was found in Apache Camel JMS components. A remote attacker can exploit a deserialization vulnerability by sending a specially crafted ObjectMessage to a queue or topic consumed by an affected Camel application. This bypasses existing security checks, allowing the attacker to inject...

CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-43866

A flaw was found in Apache Camel JMS components. A remote attacker can exploit a deserialization vulnerability by sending a specially crafted ObjectMessage to a queue or topic consumed by an affected Camel application. This bypasses existing security checks, allowing the attacker to inject...

CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-43866

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-40860

A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service JMS ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message paylo...

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

EUVD-2026-25794

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

CVE-2026-40860

Apache Camel CVE-2026-40860 describes unsafe deserialization of JMS ObjectMessage payloads in camel-jms, camel-sjms, camel-sjms2 and camel-amqp. The root cause is deserialization via javax.jms.ObjectMessage.getObject() without ObjectInputFilter or allow/deny lists, triggered when mapJmsMessage is...

EUVD-2021-7743

Malicious code in bioql PyPI...

EUVD-2022-3674

Malicious code in bioql PyPI...

GHSA-Q9HR-3PG4-3JP4 Improper Input Validation in Apache ActiveMQ

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

Remote Code Execution (RCE)

Artemis in EAP 7 is vulnerable to remote code execution. The vulnerability exists due to a lack of validation of permissions of the application using a JMS ObjectMessage allowing an attacker to execute maliciously craft code in the system...

7: Incomplete fix of CVE-2016-4978 in HornetQ library

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...