CVE-2026-40048

Critical [CVE-2026-40048 +2] Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component

CVE-2026-43867Source published Jul 6, 2026Source updated Jul 7, 2026

This bulletin covers 3 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a…

Affected products in this advisory

• Apache Camel PQC

Source-reported affected versions

• 4.18.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.18.3

Mitigation guidance

• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3.

Workarounds

• For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write.

High [CVE-2026-40048 +1] Deserialization of Untrusted Data vulnerability in Apache Camel PQC component

CVE-2026-46590Source published Jul 6, 2026Source updated Jul 8, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. The same unfiltered legacy-migration read also remained in FileBasedKeyLifecycleManager (for the stored KeyPair and KeyMetadata). A principal who can write to the…

Affected products in this advisory

• Apache Camel PQC

Source-reported affected versions

• 4.18.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.18.3

Mitigation guidance

• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3.

Workarounds

• For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application's own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any data that less-trusted principals can write.

High [CVE-2026-40048] Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

CVE-2026-40048Source published Apr 27, 2026Source updated Jul 15, 2026

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security. KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results…

Affected products in this advisory

• Apache Camel

Source-reported affected versions

• Apache Camel PQC 4.19.0 before 4.20.0
• Apache Camel PQC 4.18.0 before 4.18.2

Source-reported fixed versions

• 4.20.0
• 4.18.2

Mitigation guidance

• Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding.
• For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.

High [CVE-2026-40048] Arbitrary code execution via insecure deserialization of crafted key files

CVE-2026-40048Source published Apr 27, 2026

Arbitrary code execution via insecure deserialization of crafted key files. Red Hat rates this important (CVSS 7.8). Weakness: CWE-502. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.

Related products — impact not confirmed

• Red Hat Enterprise Linux

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.