PT-2026-35371 · Apache · Apache Camel

Venkatraman Kumar · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-40473

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.5 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.9

Description The camel-mina component contains a flaw in the MinaConverter.toObjectInput(IoBuffer) function where it wraps an IoBuffer in a java.io.ObjectInputStream without implementing an ObjectInputFilter or class-loading restrictions. When a Camel route utilizes camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (such as through getBody(ObjectInput.class) or @Body ObjectInput), a remote attacker can send a crafted serialized Java object to the MINA consumer port. This can lead to arbitrary code execution within the application context during the readObject() process due to unsafe deserialization.

Recommendations Upgrade to version 4.14.6 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x releases stream. Upgrade to version 4.20.0 for all other affected versions.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-06060

CVE-2026-40473

GHSA-VPR3-2659-RW55

Affected Products

Apache Camel

References · 17

• https://osv.dev/vulnerability/GHSA-vpr3-2659-rw55 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06060 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40473 · Security Note
• https://camel.apache.org/security/CVE-2026-40473.html · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/b605816d11c253d22989abc290c198be83e3f817 · Note
• https://github.com/apache/camel/pull/22583 · Note
• https://github.com/apache/camel/commit/8e7f6335d2b4b096df26f8221723405ceaee275a · Note
• https://github.com/apache/camel/pull/22584 · Note
• https://github.com/apache/camel/pull/22585 · Note
• https://github.com/apache/camel/commit/c35b0a3720f8c80025b06112d5d9c2932426d7f0 · Note
• https://twitter.com/infoflowcloud/status/2048853791340982713 · Twitter Post
• https://github.com/dinosn/apache-camel · Note
• https://twitter.com/CVEnew/status/2048852241021300947 · Twitter Post
• https://t.me/CVEtracker/51906 · Telegram Post