Vulnerability · Published Apr 27, 2026 · Assigned by apache
CVE-2026-40860Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache Camel from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6. This issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.camel:camel-activemq | 4.14.7 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-activemq | 4.20.0 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-activemq | 4.18.2 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-activemq6 | 4.20.0 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-activemq6 | 4.18.2 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-activemq6 | 4.14.7 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-amqp | 4.14.7 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-amqp | 4.18.2 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-amqp | 4.20.0 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-jms | 4.14.7 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-jms | 4.20.0 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-jms | 4.18.2 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-sjms | 4.20.0 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-sjms | 4.18.2 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-sjms | 4.14.7 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-sjms2 | 4.20.0 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-sjms2 | 4.14.7 | GHSA-m5vh-3fw5-5wgh |
| Maven | org.apache.camel:camel-sjms2 | 4.18.2 | GHSA-m5vh-3fw5-5wgh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Camel | 3.0.0 – before 4.14.74.15.0 – before 4.18.24.19.0 – before 4.20.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://camel.apache.org/security/CVE-2026-40860.html vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/04/26/10
- https://access.redhat.com/security/cve/CVE-2026-40860 vdb-entry, x_refsource_REDHAT
- RHBZ#2463172 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40860.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22453 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17668 vendor-advisory, x_refsource_REDHAT