PT-2026-35371 · Apache · Apache Camel

Venkatraman Kumar · CVE-2026-40473 · Published 2026-04-27 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.5 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.9

Description A flaw in the camel-mina component allows a remote attacker to achieve arbitrary code execution by sending a specially crafted serialized Java object over the network to the MINA consumer port. The MinaConverter.toObjectInput() type converter, used when a Camel route processes network input, fails to apply necessary security filters or class-loading restrictions during object deserialization. This occurs when the converter wraps an IoBuffer in a java.io.ObjectInputStream without an ObjectInputFilter, enabling malicious code execution within the application context during the readObject() process.

Recommendations Upgrade to version 4.14.6 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x releases stream. Upgrade to version 4.20.0 for all other affected versions.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-06060

CVE-2026-40473

GHSA-VPR3-2659-RW55

Affected Products

Apache Camel

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40473.json · Exploit
• https://camel.apache.org/security/CVE-2026-40473.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40473 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40473 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06060 · Security Note
• https://osv.dev/vulnerability/GHSA-vpr3-2659-rw55 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/22585 · Note
• https://github.com/apache/camel/pull/22584 · Note
• https://github.com/apache/camel/commit/b605816d11c253d22989abc290c198be83e3f817 · Note
• https://github.com/apache/camel/commit/c35b0a3720f8c80025b06112d5d9c2932426d7f0 · Note
• https://github.com/apache/camel/commit/8e7f6335d2b4b096df26f8221723405ceaee275a · Note
• https://github.com/apache/camel/pull/22583 · Note
• https://issues.apache.org/jira/browse/CAMEL-23319 · Note
• https://twitter.com/CVEnew/status/2048852241021300947 · Twitter Post