CVE catalog
CVE-2026-40860
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() w
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.74% · Oct 25, 2026
A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service (JMS) ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message payload without proper validation. Successful exploitation could lead to remote code execution on the system consuming the message, provided a deserialization gadget chain is present on the classpath. Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | camel | Not reported | 4.14.7 | fixed |
| Cpe | camel | Not reported | 4.18.2 | fixed |
| Cpe | camel | Not reported | Not reported | unknown |
| Maven | org.apache.camel:camel-jms | Not reported | 4.20.0 | fixed |
| Maven | org.apache.camel:camel-sjms | Not reported | 4.20.0 | fixed |
| Maven | org.apache.camel:camel-sjms2 | Not reported | 4.20.0 | fixed |
| Maven | org.apache.camel:camel-amqp | Not reported | 4.20.0 | fixed |
| Maven | org.apache.camel:camel-activemq | Not reported | 4.20.0 | fixed |
| Maven | org.apache.camel:camel-activemq6 | Not reported | 4.20.0 | fixed |
| Cpe | camel | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | camel | cpe | Not reported | 4.14.7 | Not reported | Not reported | Not reported |
| Cpe | camel | cpe | Not reported | 4.18.2 | Not reported | Not reported | Not reported |
| Maven | org.apache.camel:camel-jms | maven | Not reported | 4.20.0 | Not reported | GHSA-M5VH-3FW5-5WGH | Not reported |
| Maven | org.apache.camel:camel-sjms | maven | Not reported | 4.20.0 | Not reported | GHSA-M5VH-3FW5-5WGH | Not reported |
| Maven | org.apache.camel:camel-sjms2 | maven | Not reported | 4.20.0 | Not reported | GHSA-M5VH-3FW5-5WGH | Not reported |
| Maven | org.apache.camel:camel-amqp | maven | Not reported | 4.20.0 | Not reported | GHSA-M5VH-3FW5-5WGH | Not reported |
| Maven | org.apache.camel:camel-activemq | maven | Not reported | 4.20.0 | Not reported | GHSA-M5VH-3FW5-5WGH | Not reported |
| Maven | org.apache.camel:camel-activemq6 | maven | Not reported | 4.20.0 | Not reported | GHSA-M5VH-3FW5-5WGH | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [http://www.openwall.com/lists/oss-security/2026/04/26/10]
- [https://access.redhat.com/errata/RHSA-2026:17668]
- [https://access.redhat.com/errata/RHSA-2026:22453]
- [https://access.redhat.com/security/cve/CVE-2026-40860]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2463172]
- [https://camel.apache.org/security/CVE-2026-40860.html]
- [https://github.com/advisories/GHSA-m5vh-3fw5-5wgh]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-40860]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40860.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2308.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]