Loading...
Skip to main content
GeekWala

CVE-2026-40858 — Vulnerability in...

HIGH

Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

Published April 27, 2026Updated May 5, 2026Source: osv

Summary

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2. The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23322 refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

Advisory Timeline

  • First published April 27, 2026 (168 days ago).
  • Last revised May 5, 2026 — 8 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.apache.camel:camel-infinispan to 4.14.7 or later
<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-infinispan -->
Maven
Update org.apache.camel:camel-infinispan to 4.20.0 or later
<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-infinispan -->
Maven
Update org.apache.camel:camel-infinispan to 4.18.2 or later
<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-infinispan -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.apache.camel:camel-infinispan
maven
4.0.0, 4.0.1, 4.0.2, 4.0.3 (+46 more)4.14.7
org.apache.camel:camel-infinispan
maven
4.19.04.20.0
org.apache.camel:camel-infinispan
maven
4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more)4.18.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-40858?
Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-40858?
CVE-2026-40858 affects org.apache.camel:camel-infinispan. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-40858 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-4xwx-hvv7-7prj

Related CVEs

  • CVE-2026-40453
    CRITICAL

    Apache Camel has an incomplete fix for CVE-2025-27636

  • CVE-2026-71300
    CRITICAL

    Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

  • CVE-2026-40860
    CRITICAL

    Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

  • CVE-2026-46455
    CRITICAL

    Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

  • CVE-2026-40859
    HIGH

    Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

  • CVE-2026-42527
    HIGH

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  • CVE-2026-43866
    HIGH

    Apache Camel JMS deserialization filter bypass

  • CVE-2026-46592
    HIGH

    Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies