CVE-2026-40859

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.19.9

Description The camel-vertx-http component deserializes HTTP response bodies with the application/x-java-serialized-object Content-Type using a raw java.io.ObjectInputStream without an ObjectInputFilter in the deserializeJavaObjectFromStream() function. This occurs when the producer endpoint is configured with transferException=true (or allowJavaSerializedObject=true) and throwExceptionOnFailure is set to true. In these conditions, a backend HTTP response with a 5xx status and the specified content type is deserialized without class restrictions. An attacker controlling the backend or performing a man-in-the-middle attack on an unencrypted HTTP connection can send a crafted serialized Java object to achieve remote code execution on the host, provided a suitable gadget chain exists on the classpath.

Recommendations Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. Upgrade to version 4.20.0. Do not enable transferException=true or allowJavaSerializedObject=true on producers communicating with untrusted or network-reachable backends. Ensure producer connections use TLS (https) to prevent man-in-the-middle response substitution. Set an explicit -Djdk.serialFilter allow-list to constrain deserialization.