Read the docs
TI-2026-29225 Aliases CVE-2026-40473GHSA-vpr3-2659-rw55

Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject(). This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01188 68th percentileScored 2026-11-07
Fix Fixed Apache Camel Mina (Apache Software Foundation): 4.14.6, 4.18.2, 4.20.0org.apache.camel:camel-mina (Maven): 4.14.6, 4.18.2, 4.20.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel Mina3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.04.14.6, 4.18.2, 4.20.0Patch availableCNA
—org.apache.camel:camel-mina (Maven)3.0.0 to before 4.14.64.14.6Patch availableGHSA-vpr3-2659-rw55
—org.apache.camel:camel-mina (Maven)4.15.0 to before 4.18.24.18.2Patch availableGHSA-vpr3-2659-rw55
—org.apache.camel:camel-mina (Maven)4.19.0 to before 4.20.04.20.0Patch availableGHSA-vpr3-2659-rw55
  • Apache Camel Mina VendorApache Affected 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2; 4.19.0 to before 4.20.0 Fixed in 4.14.6, 4.18.2, 4.20.0 Patch available CNA
  • org.apache.camel:camel-mina (Maven) Vendor— Affected 3.0.0 to before 4.14.6 Fixed in 4.14.6 Patch available GHSA-vpr3-2659-rw55
  • org.apache.camel:camel-mina (Maven) Vendor— Affected 4.15.0 to before 4.18.2 Fixed in 4.18.2 Patch available GHSA-vpr3-2659-rw55
  • org.apache.camel:camel-mina (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-vpr3-2659-rw55

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2VulnerableApache
cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*4.19.0VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.14.6; 4.15.0 to before 4.18.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:* Versions 4.19.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Camel Mina (Apache Software Foundation) Fixed in 4.14.6, 4.18.2, 4.20.0
  • Fix · GHSA-vpr3-2659-rw55 org.apache.camel:camel-mina (Maven) Fixed in 4.14.6 Advisory →
  • Fix · GHSA-vpr3-2659-rw55 org.apache.camel:camel-mina (Maven) Fixed in 4.18.2 Advisory →
  • Fix · GHSA-vpr3-2659-rw55 org.apache.camel:camel-mina (Maven) Fixed in 4.20.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Fuse 7
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40473
  2. 2026-10-03 Alias added: GHSA-vpr3-2659-rw55

References

Advisory 3

Other 8

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences