CVE-2026-40860 — Vulnerability in org.apache.camel:camel-activemq6...
CRITICAL
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
Published April 27, 2026Updated August 26, 2026Source: osv
Summary
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6.
This issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.
Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Advisory Timeline
- First published April 27, 2026 (168 days ago).
- Last revised August 26, 2026 — 121 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.apache.camel:camel-activemq6 to 4.14.7 or later<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-activemq6 -->
Maven
Update org.apache.camel:camel-amqp to 4.18.2 or later<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-amqp -->
Maven
Update org.apache.camel:camel-amqp to 4.14.7 or later<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-amqp -->
Maven
Update org.apache.camel:camel-activemq to 4.14.7 or later<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-activemq -->
Maven
Update org.apache.camel:camel-jms to 4.14.7 or later<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-jms -->
Maven
Update org.apache.camel:camel-sjms2 to 4.14.7 or later<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-sjms2 -->
Maven
Update org.apache.camel:camel-jms to 4.18.2 or later<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-jms -->
Maven
Update org.apache.camel:camel-sjms2 to 4.18.2 or later<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-sjms2 -->
Maven
Update org.apache.camel:camel-activemq to 4.20.0 or later<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-activemq -->
Maven
Update org.apache.camel:camel-activemq to 4.18.2 or later<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-activemq -->
Maven
Update org.apache.camel:camel-sjms to 4.14.7 or later<!-- Update pom.xml dependency version to 4.14.7 for org.apache.camel:camel-sjms -->
Maven
Update org.apache.camel:camel-sjms to 4.18.2 or later<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-sjms -->
Maven
Update org.apache.camel:camel-sjms to 4.20.0 or later<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-sjms -->
Maven
Update org.apache.camel:camel-activemq6 to 4.18.2 or later<!-- Update pom.xml dependency version to 4.18.2 for org.apache.camel:camel-activemq6 -->
Maven
Update org.apache.camel:camel-sjms2 to 4.20.0 or later<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-sjms2 -->
Maven
Update org.apache.camel:camel-jms to 4.20.0 or later<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-jms -->
Maven
Update org.apache.camel:camel-amqp to 4.20.0 or later<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-amqp -->
Maven
Update org.apache.camel:camel-activemq6 to 4.20.0 or later<!-- Update pom.xml dependency version to 4.20.0 for org.apache.camel:camel-activemq6 -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (18)
Affects 1 ecosystem: maven (6).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.camel:camel-activemq6 | maven | 4.10.0, 4.10.1, 4.10.2, 4.10.3 (+28 more) | 4.14.7 |
| org.apache.camel:camel-amqp | maven | 4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more) | 4.18.2 |
| org.apache.camel:camel-amqp | maven | 3.0.0, 3.0.1, 3.1.0, 3.10.0 (+131 more) | 4.14.7 |
| org.apache.camel:camel-activemq | maven | 3.0.0, 3.0.1, 3.1.0, 3.10.0 (+128 more) | 4.14.7 |
| org.apache.camel:camel-jms | maven | 3.0.0, 3.0.1, 3.1.0, 3.10.0 (+131 more) | 4.14.7 |
| org.apache.camel:camel-sjms2 | maven | 3.0.0, 3.0.1, 3.1.0, 3.10.0 (+131 more) | 4.14.7 |
| org.apache.camel:camel-jms | maven | 4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more) | 4.18.2 |
| org.apache.camel:camel-sjms2 | maven | 4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more) | 4.18.2 |
| org.apache.camel:camel-activemq | maven | 4.19.0 | 4.20.0 |
| org.apache.camel:camel-activemq | maven | 4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more) | 4.18.2 |
| org.apache.camel:camel-sjms | maven | 3.0.0, 3.0.1, 3.1.0, 3.10.0 (+131 more) | 4.14.7 |
| org.apache.camel:camel-sjms | maven | 4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more) | 4.18.2 |
| org.apache.camel:camel-sjms | maven | 4.19.0 | 4.20.0 |
| org.apache.camel:camel-activemq6 | maven | 4.15.0, 4.16.0, 4.17.0, 4.18.0 (+1 more) | 4.18.2 |
| org.apache.camel:camel-sjms2 | maven | 4.19.0 | 4.20.0 |
| org.apache.camel:camel-jms | maven | 4.19.0 | 4.20.0 |
| org.apache.camel:camel-amqp | maven | 4.19.0 | 4.20.0 |
| org.apache.camel:camel-activemq6 | maven | 4.19.0 | 4.20.0 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-40860ADVISORY
- https://github.com/apache/camel/pull/22598WEB
- https://github.com/apache/camel/pull/22603WEB
- https://github.com/apache/camel/pull/22604WEB
- https://github.com/apache/camel/pull/22639WEB
- https://github.com/apache/camel/commit/0c06142c46a1422b6b49fab784a1087c50e48ee8WEB
- https://github.com/apache/camel/commit/107e8c279cf9bf488843e33fb6333cc2d7f37c67WEB
- https://github.com/apache/camel/commit/6a82709f0fc5431f46d2939547aacd2c7395c97aWEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40860.jsonWEB
- https://issues.apache.org/jira/browse/CAMEL-23321WEB
- https://github.com/apache/camel/releases/tag/camel-4.20.0WEB
- https://github.com/apache/camel/releases/tag/camel-4.18.2WEB
- https://github.com/apache/camel/releases/tag/camel-4.14.7WEB
- https://github.com/apache/camelPACKAGE
- https://camel.apache.org/security/CVE-2026-40860.htmlWEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2463172WEB
- https://access.redhat.com/security/cve/CVE-2026-40860WEB
- https://access.redhat.com/errata/RHSA-2026:22453WEB
- https://access.redhat.com/errata/RHSA-2026:17668WEB
- https://www.openwall.com/lists/oss-security/2026/04/26/10WEB
Frequently Asked Questions
- What is CVE-2026-40860?
- Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2026-40860?
- CVE-2026-40860 affects org.apache.camel:camel-activemq6, org.apache.camel:camel-amqp and org.apache.camel:camel-activemq (and 3 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-40860 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-m5vh-3fw5-5wgh
Related CVEs
- CVE-2026-48204CRITICAL
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
- CVE-2026-48205CRITICAL
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
- CVE-2026-40453CRITICAL
Apache Camel has an incomplete fix for CVE-2025-27636
- CVE-2026-71300CRITICAL
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
- CVE-2026-40859HIGH
Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
- CVE-2026-42527HIGH
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
- CVE-2026-43866HIGH
Apache Camel JMS deserialization filter bypass
- CVE-2026-46592HIGH
Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies