Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 3 advisories

CVE-2026-40860

CVE-2026-40860: 3 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

2 advisories
  • Advisory severityCritical9.8

    Critical [CVE-2026-40860] Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

    CVE-2026-40860Source published Source updated

    JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms. ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other…

    Affected products in this advisory
    • Apache Camel
    • ActiveMQ
    Source-reported affected versions
    • Apache Camel 3.0.0 before 4.14.7
    • Apache Camel 4.15.0 before 4.18.2
    • Apache Camel 4.19.0 before 4.20.0
    Source-reported fixed versions
    • 4.14.7
    • 4.18.2
    • 4.20.0
    Mitigation guidance
    • Users are recommended to upgrade to version 4.20.0, which fixes the issue.
    • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7.
    • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityHigh7.3

    High [CVE-2026-40860 +1] Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component

    CVE-2026-43866Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 hardening added a post-deserialization class check that rejects classes outside the default allow-list java.**;javax.**;org.apache.camel.**;!*. However org.apache.camel.support.DefaultExchangeHolder itself lives in the allow-listed org.apache.camel.** namespace, so an ObjectMessage whose top-level object is a DefaultExchangeHolder passes the check. The receiving side then calls…

    Affected products in this advisory
    • Apache Camel JMS
    Source-reported affected versions
    • 3.0.0 through 4.14.8
    • 4.15.0 through 4.18.3
    • 4.19.0 through 4.21.0
    • 4.19.0 through 4.21.0.
    Source-reported fixed versions
    • 4.21.0
    • 4.14.8
    • 4.18.3
    Mitigation guidance
    • Users are recommended to upgrade to version 4.21.0, which fixes the issue.
    • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
    • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
    Workarounds
    • For deployments that cannot upgrade immediately, restrict publish access to the queues and topics consumed by Camel to trusted producers via JMS broker authorization, and do not expose JMS consumers that map ObjectMessage bodies to untrusted networks; a JMS-provider deserialization allow-list does not mitigate this specific bypass because the crafted payload uses only universally-trusted classes.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-40860] Remote Code Execution via deserialization of JMS ObjectMessage

    CVE-2026-40860Source published

    Remote Code Execution via deserialization of JMS ObjectMessage. Red Hat rates this important (CVSS 7.5). Weakness: CWE-502. Affected package(s): camel-jms, camel-amqp. Resolved in Red Hat advisory RHSA-2026:22453 — update the affected packages (`sudo dnf update`).

    Affected products in this advisory
    • Red Hat build of Apache Camel 4 for Quarkus 3
    Source-reported affected versions
    • camel-jms
    • camel-amqp
    Source-reported fixed versions
    • RHSA-2026:22453
    Mitigation guidance
    • Update the affected package(s) to the fixed version shipped in RHSA-2026:22453 (`sudo dnf update` / `yum update`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features