Apache Camel Deserialization Flaws Expose JMS, Mina, and Infinispan Deployments to RCE

Apache disclosed three unsafe deserialization vulnerabilities in Apache Camel that can lead to remote code execution in deployments using camel-mina, JMS-related components, and camel-infinispan. CVE-2026-40473 affects camel-mina, where MinaConverter.toObjectInput() wraps network-supplied TCP or UDP data in java.io.ObjectInputStream without ObjectInputFilter or class-loading restrictions; a crafted serialized Java object can execute during readObject(). CVE-2026-40860 affects camel-jms, camel-sjms, camel-sjms2, and camel-amqp, where Camel deserializes JMS ObjectMessage payloads through ObjectMessage.getObject() with the default mapJmsMessage option enabled and without filtering or allow/deny lists, allowing an attacker who can publish to a consumed queue or topic to trigger code execution if a gadget chain is present.

Apache also disclosed CVE-2026-40858 in camel-infinispan, where the ProtoStream-based remote aggregation repository deserializes data from a remote Infinispan cache using java.io.ObjectInputStream without an input filter; an attacker able to write to the cache can inject a malicious serialized object that executes during normal get or recover operations. The affected versions span multiple Camel release lines, including 3.0.0 and later for the JMS issue, 3.0.0 and later for camel-mina, and 4.0.0 and later for camel-infinispan, with fixes released in 4.20.0 and backported to supported streams including 4.14.6/4.14.7 and 4.18.2. Apache tracks the flaws as CAMEL-23319, CAMEL-23321, and CAMEL-23322, with reports credited to researchers from Securin and Innora Pte. Ltd.