PT-2026-35386 · Apache · Camel-Infinispan

Feng Ning · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-40858

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Camel camel-infinispan (affected versions not specified)

Description The DefaultExchangeHolderUtils.deserialize() function in the camel-infinispan component contains a flaw in its deserialization mechanism. Specifically, the ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using ObjectInputStream. This could allow a remote attacker to execute arbitrary code by sending a specially crafted packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-06061

CVE-2026-40858

GHSA-4XWX-HVV7-7PRJ

Affected Products

Camel-Infinispan

References · 21

• https://osv.dev/vulnerability/GHSA-4xwx-hvv7-7prj · Vendor Advisory
• https://camel.apache.org/security/CVE-2026-40858.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06061 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40858 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/05cffa5ec05ff2ec3c50a77825625da6e426e7a8 · Note
• https://github.com/apache/camel/pull/22151 · Note
• https://github.com/apache/camel/commit/540d48e1cb5e492bd1c74bfc5a6e929fcf24fe3b · Note
• https://github.com/apache/camel/pull/22148 · Note
• https://github.com/apache/camel/pull/22146 · Note
• https://github.com/apache/camel/pull/22150 · Note
• https://github.com/apache/camel/pull/22147 · Note
• https://github.com/apache/camel/pull/22149 · Note
• https://github.com/apache/camel/commit/5c20de8f047de725e0b32a874cdb5108c3e46558 · Note
• https://github.com/apache/camel/commit/0307dd4709a8136eba3206701004bcb528bc47fd · Note