CVE-2026-40859 Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

CVE-2026-40859: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter...

PT-2026-55882

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.19.9 Description The camel-vertx-http component deserializes HTTP response bodies with the...

ai.pipestream.module:module-chunker (0.1.3), ai.pipestream.module:module-echo (0.1.3) +805 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0.cr1, =0.0.22, =0.7.28, =0.7.28, =0.7.25, =0.7.25, =0.7.28, =0.7.28, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.29 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1139 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=1.20.1) +2680 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=0.23.0, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0.cr1, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0.cr1, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-50559 Source advisory:...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1139 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-173750...

ai.pipestream.module:module-chunker (0.1.3), ai.pipestream.module:module-echo (0.1.3) +805 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0.cr1, =0.0.22, =0.7.28, =0.7.28, =0.7.25, =0.7.25, =0.7.28, =0.7.28, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.29 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375081...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.9.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.9.38, <=1.20.1) +1794 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.0.0.alpha1, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.alpha1, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.1, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375081...

ai.pipestream.module:module-embedder (0.3.0), ai.pipestream.module:quarkus-djl-serving-embeddings (0.3.0) +176 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (3.37.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.pipestream.module:module-embedder 0.3.0 - ai.pipestream.module:quarkus-djl-serving-embeddings...

Path Equivalence

Overview io.quarkus:quarkus-vertx-http is a Cloud Native, Linux Container First framework for writing Java applications. Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP request...

com.dropchop.recyclone:recyclone-quarkus-extension (>=2.0.36, <=2.0.38), com.dropchop.recyclone:recyclone-quarkus-extension-deployment (>=2.0.36, <=2.0.38) +519 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.35.0, <=3.35.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.35.0, =2.0.36, =2.0.36, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =1.1.0, =1.1.0, =3.17.0, =3.18.0 - io.quarkiverse.asyncapi:quarkus-asyncapi-scanner 1.0.6 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

ai.pipestream:pipestream-server (>=0.7.23, <=0.7.24), ai.pipestream:pipestream-server-deployment (>=0.7.23, <=0.7.24) +272 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.34.0, <=3.34.6)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.24 - ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test 2.0.0 -...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +996 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.30.0, <=3.33.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.30.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.6, =0.1.10, =0.1.3, =0.1.3, =0.1.3, =0.1.5 - ai.pipestream:pipestream-engine 0.0.6 and more...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.21.0, <=3.27.3)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=1.20.1) +2680 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=0.23.0, <=3.20.6)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.5 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)

An update for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available RHBQ 3.27.3.SP1. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...