CVE-2026-40860
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms,…
Technology
Apache Camel
CVSS Score
9.8 / 10.0
Affected Versions
>=3.0.0 <4.14.7; >=4.15.0 <4.18.2; 4.19.0
Upstream Fix
See upstream advisory
Published
April 27, 2026
OSSeva Coverage
Fixed upstream
Description
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively
Is your Apache Camel deployment affected?
If you're running >=3.0.0 <4.14.7; >=4.15.0 <4.18.2; 4.19.0, you need this patch. Book a discovery call to get covered.