Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Camel 4.14.7, 4.18.2, 4.20.0 Clear all filters
TI-2026-29515 CVE-2026-40858 · GHSA-4xwx-hvv7-7prj

Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

Priority MEDIUM 43

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01305 Published 2026-04-27 Partial fix · 4.14.7, 4.18.2 +1 CWE-502
TI-2026-29517 CVE-2026-40860 · GHSA-m5vh-3fw5-5wgh

Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

Priority MEDIUM 52

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01739 Published 2026-04-27 Partial fix · 4.14.7, 4.18.2 +1 CWE-502