Read the docs
TI-2026-29516 Aliases CVE-2026-40859GHSA-6qw3-4796-5984

Deserialization of untrusted data in Apache Camel

Priority LOW 39CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a man-in-the-middle position on an unencrypted (plain HTTP) connection, or by compromising the backend service - can return a crafted serialized Java object and, if a suitable gadget chain is present on the classpath, achieve remote code execution on the Camel application host. The path is not reachable in the default configuration, where transferException is false. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the deserialization performed by both helper utilities is constrained by a default ObjectInputFilter (allow-list java.**;javax.**;org.apache.camel.**;!*), which can be customised through the new deserializationFilter endpoint option or the JVM-wide -Djdk.serialFilter system property. For deployments that cannot upgrade immediately: do not enable transferException=true (or allowJavaSerializedObject=true) on producers that talk to untrusted or network-reachable backends; ensure producer connections use TLS (https) so that a response cannot be substituted by a man-in-the-middle; and, where the option is required, set an explicit -Djdk.serialFilter allow-list (for example java.**;org.apache.camel.**;!*) to constrain deserialization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00886 59th percentileScored 2026-11-07
Fix Partial Apache Camel (Apache Software Foundation): 4.14.8, 4.18.3, 4.20.0org.apache.camel:camel-vertx-http (Maven): 4.14.8, 4.18.3, 4.20.0+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.20.04.14.8, 4.18.3, 4.20.0Patch availableCNA
—org.apache.camel:camel-vertx-http (Maven)4.0.0 to before 4.14.84.14.8Patch availableGHSA-6qw3-4796-5984
—org.apache.camel:camel-vertx-http (Maven)4.15.0 to before 4.18.34.18.3Patch availableGHSA-6qw3-4796-5984
—org.apache.camel:camel-vertx-http (Maven)4.19.0 to before 4.20.04.20.0Patch availableGHSA-6qw3-4796-5984
—org.apache.camel:camel-netty-http (Maven)4.0.0 to before 4.14.84.14.8Patch availableGHSA-6qw3-4796-5984
—org.apache.camel:camel-netty-http (Maven)4.15.0 to before 4.18.34.18.3Patch availableGHSA-6qw3-4796-5984
—org.apache.camel:camel-netty-http (Maven)4.19.0 to before 4.20.04.20.0Patch availableGHSA-6qw3-4796-5984
  • Apache Camel VendorApache Affected 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.20.0 Fixed in 4.14.8, 4.18.3, 4.20.0 Patch available CNA
  • org.apache.camel:camel-vertx-http (Maven) Vendor— Affected 4.0.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-6qw3-4796-5984
  • org.apache.camel:camel-vertx-http (Maven) Vendor— Affected 4.15.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-6qw3-4796-5984
  • org.apache.camel:camel-vertx-http (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-6qw3-4796-5984
  • org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.0.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-6qw3-4796-5984
  • org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.15.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-6qw3-4796-5984
  • org.apache.camel:camel-netty-http (Maven) Vendor— Affected 4.19.0 to before 4.20.0 Fixed in 4.20.0 Patch available GHSA-6qw3-4796-5984

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3VulnerableApache
cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*4.19.0VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:* Versions 4.19.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.14.8, 4.18.3, 4.20.0
  • Fix · GHSA-6qw3-4796-5984 org.apache.camel:camel-vertx-http (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-6qw3-4796-5984 org.apache.camel:camel-vertx-http (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-6qw3-4796-5984 org.apache.camel:camel-vertx-http (Maven) Fixed in 4.20.0 Advisory →
  • Fix · GHSA-6qw3-4796-5984 org.apache.camel:camel-netty-http (Maven) Fixed in 4.14.8 Advisory →
  • Fix · GHSA-6qw3-4796-5984 org.apache.camel:camel-netty-http (Maven) Fixed in 4.18.3 Advisory →
  • Fix · GHSA-6qw3-4796-5984 org.apache.camel:camel-netty-http (Maven) Fixed in 4.20.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:54622 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
  • RHSA-2026:48118 Released 2026-07-30 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
    • Red Hat Build of Apache Camel 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.2.SP3Fixed RHSA-2026:48118
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16Fixed RHSA-2026:54622
Not affected: 2 products
  • Red Hat Build of Apache Camel 3.33.2.SP3
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40859
  2. 2026-10-03 Alias added: GHSA-6qw3-4796-5984
  3. 2026-10-09 Fix available: RHSA-2026:48118 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat
  5. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.2.SP3 · Red Hat

References

Advisory 3

Other 11

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences