io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.1, <=1.3) +20 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-vertx-http (>=4.18.0, <=4.18.2)

org.apache.camel:camel-vertx-http MAVEN version =4.18.0, =0.3.0, =1.1, =1.1, =4.18.1, =3.32.0, =3.33.0, =3.33.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.2 and more Source cves: CVE-2026-42527 Source advisory:...

org.apache.camel.kafkaconnector:camel-azure-functions-sink-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.karaf:camel-vertx-http (>=4.14.5, <=4.14.7) +12 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-vertx-http (>=4.14.0, <=4.14.7)

org.apache.camel:camel-vertx-http MAVEN version =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.3) +20 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-http MAVEN version =4.15.0, =0.3.0, =1.0, =1.0, =4.18.1, =3.29.0, =3.33.0, =3.33.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.15.0, =4.18.0, =4.15.0, =4.18.2 and more Source cves: CVE-2026-40859 Source advisory:...

org.apache.camel.springboot:camel-vertx-http-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +11 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (4.19.0)

org.apache.camel:camel-vertx-http MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-vertx-http and may be impacted: - org.apache.camel.springboot:camel-vertx-http-starter 4.19.0 -...

org.apache.camel.kafkaconnector:camel-azure-functions-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.karaf:camel-vertx-http (>=4.7.0, <=4.14.7) +14 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (>=4.0.0, <=4.14.7)

org.apache.camel:camel-vertx-http MAVEN version =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.0.0, =4.0.0, =4.12.0, =4.7.0, =4.4.0, =4.8.0, =4.14.0, =4.0.0, =4.14.7 and more Source cves: CVE-2026-40859 Source advisory: OSV:GHSA-6QW3-4796-5984...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.3) +20 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-http MAVEN version =4.15.0, =0.3.0, =1.0, =1.0, =4.18.1, =3.29.0, =3.33.0, =3.33.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.15.0, =4.18.0, =4.15.0, =4.18.2 and more Source cves: CVE-2026-40859 Source advisory: GHSA-6QW3-4796-5984...

org.apache.camel.springboot:camel-vertx-http-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +11 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (4.19.0)

org.apache.camel:camel-vertx-http MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-vertx-http and may be impacted: - org.apache.camel.springboot:camel-vertx-http-starter 4.19.0 -...

org.apache.camel.kafkaconnector:camel-azure-functions-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.karaf:camel-vertx-http (>=4.7.0, <=4.14.7) +14 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (>=4.0.0, <=4.14.7)

org.apache.camel:camel-vertx-http MAVEN version =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.0.0, =4.0.0, =4.12.0, =4.7.0, =4.4.0, =4.8.0, =4.14.0, =4.0.0, =4.14.7 and more Source cves: CVE-2026-40859 Source advisory: GHSA-6QW3-4796-5984...

CVE-2026-40859

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

org.apache.camel.kafkaconnector:camel-azure-functions-sink-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.karaf:camel-vertx-http (>=4.14.5, <=4.14.7) +12 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-vertx-http (>=4.14.0, <=4.14.7)

org.apache.camel:camel-vertx-http MAVEN version =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.1, <=1.3) +20 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-vertx-http (>=4.18.0, <=4.18.2)

org.apache.camel:camel-vertx-http MAVEN version =4.18.0, =0.3.0, =1.1, =1.1, =4.18.1, =3.32.0, =3.33.0, =3.33.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.2 and more Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

io.kaoto.forage:camel-jbang-plugin-forage (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-http-grouped (>=3.35.0, <=3.36.0) +18 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-vertx-http (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.20.0 and more Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

org.apache.camel.kafkaconnector:camel-azure-functions-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.karaf:camel-vertx-http (>=4.7.0, <=4.14.7) +14 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (>=4.0.0, <=4.14.7)

org.apache.camel:camel-vertx-http MAVEN version =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.0.0, =4.0.0, =4.12.0, =4.7.0, =4.4.0, =4.8.0, =4.14.0, =4.0.0, =4.14.7 and more Source cves: CVE-2026-40859 Source advisory: MEND:CVE-2026-40859...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.3) +20 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-http MAVEN version =4.15.0, =0.3.0, =1.0, =1.0, =4.18.1, =3.29.0, =3.33.0, =3.33.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.15.0, =4.18.0, =4.15.0, =4.18.2 and more Source cves: CVE-2026-40859 Source advisory: MEND:CVE-2026-40859...

CVE-2026-40859

Apache Camel's camel-netty-http and camel-vertx-http components are vulnerable to Remote Code Execution (RCE) via unsafe deserialization of untrusted data (CWE-502 ). The vulnerability exists in NettyHttpHelper and VertxHttpHelper because they use a raw java.io.ObjectInputStream without an Object...

org.apache.camel.springboot:camel-vertx-http-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +11 more potentially affected by CVE-2026-40859 via org.apache.camel:camel-vertx-http (4.19.0)

org.apache.camel:camel-vertx-http MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-vertx-http and may be impacted: - org.apache.camel.springboot:camel-vertx-http-starter 4.19.0 -...