PT-2026-35372 · Apache · Apache Camel+6

Venkatraman Kumar · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-40860

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 4.14.6 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.x

Description The extractBodyFromJms() function in camel-jms and the JmsBinding class in camel-sjms deserialize the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without using an ObjectInputFilter, class allowlist, or class denylist. This occurs when the mapJmsMessage option is enabled and the application acts as a JMS consumer. An attacker could publish a crafted ObjectMessage to a queue or topic to achieve remote code execution if a deserialization gadget chain is present on the classpath. This issue also affects camel-sjms2, camel-amqp, camel-activemq, and camel-activemq6.

Recommendations Upgrade to version 4.14.7 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x releases stream. Upgrade to version 4.20.0 for all other affected versions.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-40860

Affected Products

Apache Camel

Camel-Activemq

Camel-Activemq6

Camel-Amqp

Camel-Jms

Camel-Sjms

Camel-Sjms2

References · 6

• https://camel.apache.org/security/CVE-2026-40860.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40860 · Security Note
• http://openwall.com/lists/oss-security/2026/04/26/10 · Note
• https://twitter.com/infoflowcloud/status/2048853738073321955 · Twitter Post
• https://t.me/CVEtracker/51909 · Telegram Post
• https://twitter.com/CVEnew/status/2048852236571206091 · Twitter Post