CVE-2026-42527 — Vulnerability in...
HIGH
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
Published July 6, 2026Updated September 10, 2026Source: osv
Summary
Deserialization of Untrusted Data vulnerability in Apache Camel.
The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. The class-level filter check passes because the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository).
This issue affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.
Users are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not include javax.**).
Advisory Timeline
- First published July 6, 2026 (98 days ago).
- Last revised September 10, 2026 — 66 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.apache.camel:camel-netty-http to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-netty-http -->
Maven
Update org.apache.camel:camel-jms to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-jms -->
Maven
Update org.apache.camel:camel-amqp to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-amqp -->
Maven
Update org.apache.camel:camel-mina to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-mina -->
Maven
Update org.apache.camel:camel-sjms to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-sjms -->
Maven
Update org.apache.camel:camel-vertx-http to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-vertx-http -->
Maven
Update org.apache.camel:camel-consul to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-consul -->
Maven
Update org.apache.camel:camel-cassandraql to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-cassandraql -->
Maven
Update org.apache.camel:camel-sql to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-sql -->
Maven
Update org.apache.camel:camel-consul to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-consul -->
Maven
Update org.apache.camel:camel-netty to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-netty -->
Maven
Update org.apache.camel:camel-infinispan to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-infinispan -->
Maven
Update org.apache.camel:camel-mina to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-mina -->
Maven
Update org.apache.camel:camel-leveldb to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-leveldb -->
Maven
Update org.apache.camel:camel-sjms to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-sjms -->
Maven
Update org.apache.camel:camel-cassandraql to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-cassandraql -->
Maven
Update org.apache.camel:camel-consul to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-consul -->
Maven
Update org.apache.camel:camel-netty-http to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-netty-http -->
Maven
Update org.apache.camel:camel-vertx-http to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-vertx-http -->
Maven
Update org.apache.camel:camel-amqp to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-amqp -->
Maven
Update org.apache.camel:camel-leveldb to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-leveldb -->
Maven
Update org.apache.camel:camel-sql to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-sql -->
Maven
Update org.apache.camel:camel-netty to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-netty -->
Maven
Update org.apache.camel:camel-netty-http to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-netty-http -->
Maven
Update org.apache.camel:camel-infinispan to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-infinispan -->
Maven
Update org.apache.camel:camel-leveldb to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-leveldb -->
Maven
Update org.apache.camel:camel-cassandraql to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-cassandraql -->
Maven
Update org.apache.camel:camel-infinispan to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-infinispan -->
Maven
Update org.apache.camel:camel-vertx-http to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-vertx-http -->
Maven
Update org.apache.camel:camel-jms to 4.21.0 or later<!-- Update pom.xml dependency version to 4.21.0 for org.apache.camel:camel-jms -->
Maven
Update org.apache.camel:camel-amqp to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-amqp -->
Maven
Update org.apache.camel:camel-mina to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-mina -->
Maven
Update org.apache.camel:camel-sjms to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-sjms -->
Maven
Update org.apache.camel:camel-jms to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-jms -->
Maven
Update org.apache.camel:camel-sql to 4.18.3 or later<!-- Update pom.xml dependency version to 4.18.3 for org.apache.camel:camel-sql -->
Maven
Update org.apache.camel:camel-netty to 4.14.8 or later<!-- Update pom.xml dependency version to 4.14.8 for org.apache.camel:camel-netty -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (36)
Affects 1 ecosystem: maven (12).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.camel:camel-netty-http | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-jms | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-amqp | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-mina | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-sjms | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-vertx-http | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-consul | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-cassandraql | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-sql | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-consul | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-netty | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-infinispan | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-mina | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-leveldb | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-sjms | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-cassandraql | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-consul | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-netty-http | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-vertx-http | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-amqp | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-leveldb | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-sql | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-netty | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-netty-http | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-infinispan | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-leveldb | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-cassandraql | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-infinispan | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-vertx-http | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-jms | maven | 4.19.0, 4.20.0 | 4.21.0 |
| org.apache.camel:camel-amqp | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-mina | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-sjms | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-jms | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
| org.apache.camel:camel-sql | maven | 4.18.0, 4.18.1, 4.18.2 | 4.18.3 |
| org.apache.camel:camel-netty | maven | 4.14.0, 4.14.1, 4.14.2, 4.14.3 (+4 more) | 4.14.8 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.1 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-42527ADVISORY
- https://github.com/apache/camel/pull/22801WEB
- https://github.com/apache/camel/pull/22813WEB
- https://github.com/apache/camel/pull/22815WEB
- https://github.com/apache/camel/commit/1b60801edf9864465db7abf391539ee425a53e2cWEB
- https://github.com/apache/camel/commit/1ea8bf4b20898a570f0ac366c9be07ec300cce8dWEB
- https://github.com/apache/camel/commit/bc7f8cafd1d4752bf6b5a77c19fe9878258faffbWEB
- https://camel.apache.org/security/CVE-2026-42527.htmlWEB
- https://github.com/apache/camelPACKAGE
- https://github.com/apache/camel/releases/tag/camel-4.14.7WEB
- https://github.com/apache/camel/releases/tag/camel-4.18.2WEB
- https://github.com/apache/camel/releases/tag/camel-4.21.0WEB
- https://issues.apache.org/jira/browse/CAMEL-23372WEB
- https://www.openwall.com/lists/oss-security/2026/07/05/4WEB
Frequently Asked Questions
- What is CVE-2026-42527?
- Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.1/10).
- How do I check if my project is affected by CVE-2026-42527?
- CVE-2026-42527 affects org.apache.camel:camel-netty-http, org.apache.camel:camel-jms and org.apache.camel:camel-amqp (and 9 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-42527 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.1
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-8h6p-jvhf-9hcr
Related CVEs
- CVE-2017-12633CRITICAL
Apache Camel camel-hessian component vulnerable to Java object deserialization
- CVE-2026-33453CRITICAL
Apache camel-coap allows header injection that can lead to remote code execution
- CVE-2026-40453CRITICAL
Apache Camel has an incomplete fix for CVE-2025-27636
- CVE-2026-40860CRITICAL
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
- CVE-2026-40859HIGH
Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
- CVE-2026-43866HIGH
Apache Camel JMS deserialization filter bypass
- CVE-2026-46592HIGH
Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation
- CVE-2026-40473HIGH
Camel-MINA Vulnerable to Deserialization of Untrusted Data
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies