CVE-2026-42527

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.67% · Oct 25, 2026

A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machine (JVM) can be coerced into performing DNS lookups during the deserialization process. This provides an attacker with an information disclosure side channel, with the highest risk observed in the camel-jms family of components. camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of untrusted data Moderate: Apache Camel components are susceptible to information disclosure through deserialization of untrusted data. When an attacker provides a specially crafted Java-serialized payload to an affected Camel consumer, the default ObjectInputFilter pattern allows DNS queries to an attacker-controlled host. This vulnerability primarily impacts deployments where camel-jms is used with mapJmsMessage=true (default), enabling an out-of-band side channel for information leakage. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.