CVE-2026-40859
CVE-2026-40859: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityHigh8.1
High [CVE-2026-40859] Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel.
CVE-2026-40859Source published Source updated
Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- 4.0.0 through 4.14.8
- 4.15.0 through 4.18.3
- 4.19.0 through 4.20.0.
- Source-reported fixed versions
- 4.20.0
- 4.14.8
- 4.18.3
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityHigh8.1
High [CVE-2026-40859] Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data
CVE-2026-40859Source published Source updated
Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a…
- Affected products in this advisory
- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
- Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
- Red Hat build of Apache Camel 4 for Quarkus 3
- Source-reported affected versions
- < 4.0.0
- < 4.14.8
- < 4.15.0
- < 4.18.3
2 more entries in the full advisory.
- Source-reported fixed versions
- 4.20.0
- 4.14
- 4.14.8
- 4.18
4 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, avoid enabling `transferException=true` or `allowJavaSerializedObject=true` on Apache Camel `camel-vertx-http` producer endpoints that communicate with untrusted or network-reachable backend services. Ensure all producer connections utilize TLS (HTTPS) to prevent man-in-the-middle attacks. If enabling these options is necessary, configure a strict deserialization filter using the `-Djdk.serialFilter` JVM system property, for example: `-Djdk.serialFilter="java.**;org.apache.camel.**;!*"`. This will restrict the classes allowed during deserialization, limiting the potential impact.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.