High8.1Red Hat Linux

High [CVE-2026-43866] Apache Camel JMS components: Arbitrary Exchange state injection

This high-severity Red Hat Linux advisory covers CVE-2026-43866 affecting Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16.

CVE-2026-43866 Published Jul 6, 2026Updated by vendor Jul 6, 2026

CVE-2026-43866

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.

ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 hardening added a post-deserialization class check that rejects classes outside the default allow-list java.**;javax.**;org.apache.camel.**;!*.

However org.apache.camel.support. DefaultExchangeHolder itself lives in the allow-listed org.apache.camel.** namespace, so an ObjectMessage whose top-level object is a DefaultExchangeHolder passes the check.

The receiving side then calls DefaultExchangeHolder.unmarshal() on it without requiring the transferExchange option to be enabled - an asymmetric trust boundary, since the sending side gates ObjectMessage and transferExchange handling but the receiving side did not - writing every non-null field of the holder into the Exchange: the message body, the IN and OUT headers, the exchange properties, the variables, the exchange id and the exception.

Affected product named by the advisory: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16.

Affected versions

< 3.0.0
< 4.14.8
< 4.15.0
< 4.18.3
< 4.19.0
< 4.21.0

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Fixed versions

4.21.0
4.14
4.14.8
4.18
4.18.3
camel-jms
RHSA-2026:54622

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Restrict publish access to JMS queues and topics consumed by Camel applications via broker authorization. Note that a JMS-provider deserialization allow-list does not mitigate this specific bypass because the crafted payload uses only universally-trusted classes within the org.apache.camel namespace.

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.