Loading...
Skip to main content
GeekWala

CVE-2026-40473 — Vulnerability in org.apache.camel:camel-mina —...

HIGH

Camel-MINA Vulnerable to Deserialization of Untrusted Data

Published April 27, 2026Updated May 5, 2026Source: osv

Summary

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject(). This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Advisory Timeline

  • First published April 27, 2026 (168 days ago).
  • Last revised May 5, 2026 — 9 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.apache.camel:camel-mina to 4.14.6 or later
<!-- Update pom.xml dependency version to 4.14.6 for org.apache.camel:camel-mina -->
Maven
Update org.apache.camel:camel-mina to 4.20.0 or later
<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-mina -->
Maven
Update org.apache.camel:camel-mina to 4.18.2 or later
<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-mina -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.apache.camel:camel-mina
maven
3.0.0, 3.0.1, 3.1.0, 3.10.0 (+130 more)4.14.6
org.apache.camel:camel-mina
maven
4.19.04.20.0
org.apache.camel:camel-mina
maven
4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more)4.18.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-40473?
Camel-MINA Vulnerable to Deserialization of Untrusted Data This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-40473?
CVE-2026-40473 affects org.apache.camel:camel-mina. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-40473 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-vpr3-2659-rw55

Related CVEs

  • CVE-2017-12633
    CRITICAL

    Apache Camel camel-hessian component vulnerable to Java object deserialization

  • CVE-2026-33453
    CRITICAL

    Apache camel-coap allows header injection that can lead to remote code execution

  • CVE-2026-40453
    CRITICAL

    Apache Camel has an incomplete fix for CVE-2025-27636

  • CVE-2026-40860
    CRITICAL

    Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

  • CVE-2026-40859
    HIGH

    Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

  • CVE-2026-42527
    HIGH

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  • CVE-2026-43866
    HIGH

    Apache Camel JMS deserialization filter bypass

  • CVE-2026-46592
    HIGH

    Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies