CVE-2026-40859

[CVE catalog]

A flaw was found in the `camel-vertx-http` component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted serialized Java object. If the producer endpoint is configured to transfer exceptions, this could lead to remote code execution on the affected Camel application. org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data This vulnerability is rated as Important because it allows for remote code execution in Apache Camel applications using the `camel-vertx-http` component. Exploitation requires a non-default configuration where `transferException=true` or `allowJavaSerializedObject=true` is enabled on the producer endpoint, in addition to an attacker controlling the backend service or performing a man-in-the-middle attack on an unencrypted connection. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.89% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "camel",
      "ecosystem": "cpe",
      "fixed_version": "4.14.8"
    },
    {
      "name": "camel",
      "ecosystem": "cpe",
      "fixed_version": "4.18.3"
    },
    {
      "name": "camel",
      "ecosystem": "cpe",
      "fixed_version": ""
    },
    {
      "name": "org.apache.camel:camel-vertx-http",
      "ecosystem": "maven",
      "fixed_version": "4.20.0",
      "provider_record_id": "GHSA-6QW3-4796-5984"
    },
    {
      "name": "org.apache.camel:camel-netty-http",
      "ecosystem": "maven",
      "fixed_version": "4.20.0",
      "provider_record_id": "GHSA-6QW3-4796-5984"
    },
    {
      "name": "camel",
      "ranges": [],
      "ecosystem": "cpe",
      "fixed_version": "",
      "provider_record_id": "NVD-CVE-2026-40859"
    }
  ]
}