CVE-2026-42527

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in several components allows classes that perform network I/O, such as java.net.URL and java.net.InetAddress. An attacker can send a Java-serialized payload containing a HashMap with java.net.URL keys to an affected consumer. This triggers the JVM to issue DNS queries to an attacker-controlled host during deserialization, creating an out-of-band side channel. The risk is most significant in the camel-jms family because the extractBodyFromJms() function in JmsBinding unconditionally invokes getObject() when the mapJmsMessage variable is set to true. Affected components include camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, and camel-sql.

Recommendations Update Apache Camel versions 4.14.0 through 4.14.7 to version 4.14.8. Update Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Update Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. Configure a JMS-provider-side allow-list using deserializationAllowList or deserializationDenyList in Apache ActiveMQ Artemis, or org.apache.activemq.SERIALIZABLE PACKAGES in Apache ActiveMQ Classic. Override the default filter via the deserializationFilter option at the endpoint level or the -Djdk.serialFilter JVM system property using the pattern !java.net.**;java.**;javax.**;org.apache.camel.**;!* (or !java.net.**;java.**;org.apache.camel.**;!* for aggregation-repository components).