CVE-2026-40859

{
  "id": "CVE-2026-40859",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T09:16:35.520",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deserialization of Untrusted Data vulnerability in Apache Camel.\n\nThe camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a man-in-the-middle position on an unencrypted (plain HTTP) connection, or by compromising the backend service - can return a crafted serialized Java object and, if a suitable gadget chain is present on the classpath, achieve remote code execution on the Camel application host. The path is not reachable in the default configuration, where transferException is false.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the deserialization performed by both helper utilities is constrained by a default ObjectInputFilter (allow-list java.**;javax.**;org.apache.camel.**;!*), which can be customised through the new deserializationFilter endpoint option or the JVM-wide -Djdk.serialFilter system property. For deployments that cannot upgrade immediately: do not enable transferException=true (or allowJavaSerializedObject=true) on producers that talk to untrusted or network-reachable backends; ensure producer connections use TLS (https) so that a response cannot be substituted by a man-in-the-middle; and, where the option is required, set an explicit -Djdk.serialFilter allow-list (for example java.**;org.apache.camel.**;!*) to constrain deserialization."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de deserialización de datos no confiables en Apache Camel.\n\nEl componente camel-vertx-http deserializa los cuerpos de respuesta HTTP que llevan el Content-Type application/x-java-serialized-object usando un java.io.ObjectInputStream sin procesar, sin aplicar ningún ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream). Esta ruta de deserialización se alcanza solo cuando el endpoint del productor está configurado con transferException=true (o el allowJavaSerializedObject=true a nivel de componente) y throwExceptionOnFailure se deja en su valor predeterminado de true; en ese caso, una respuesta HTTP del backend con un estado 5xx y el tipo de contenido application/x-java-serialized-object tiene su cuerpo deserializado sin restricciones de clase. Un atacante que controla el backend con el que se comunica el productor de Camel - a través de una posición de man-in-the-middle en una conexión no cifrada (HTTP simple), o comprometiendo el servicio de backend - puede devolver un objeto Java serializado manipulado y, si una cadena de gadgets adecuada está presente en el classpath, lograr la ejecución remota de código en el host de la aplicación Camel. La ruta no es alcanzable en la configuración predeterminada, donde transferException es false.\nEste problema afecta a Apache Camel: desde 4.0.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.20.0.\n\nSe recomienda a los usuarios actualizar a la versión 4.20.0, que corrige el problema. Si los usuarios están en la rama de versiones LTS 4.14.x, se sugiere que actualicen a 4.14.8. Si los usuarios están en la rama de versiones 4.18.x, se sugiere que actualicen a 4.18.3. Después de la actualización, la deserialización realizada por ambas utilidades auxiliares está restringida por un ObjectInputFilter predeterminado (lista de permitidos java.;javax.;org.apache.camel.**;!*), que puede personalizarse a través de la nueva opción de endpoint deserializationFilter o la propiedad del sistema -Djdk.serialFilter a nivel de JVM. Para implementaciones que no pueden actualizarse inmediatamente: no habilite transferException=true (o allowJavaSerializedObject=true) en productores que se comunican con backends no confiables o accesibles por red; asegúrese de que las conexiones del productor usen TLS (HTTPS) para que una respuesta no pueda ser sustituida por un man-in-the-middle; y, donde la opción sea requerida, establezca una lista de permitidos -Djdk.serialFilter explícita (por ejemplo, java.;org.apache.camel.;!*) para restringir la deserialización."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.camel:camel-vertx-http",
          "versions": [
            {
              "version": "4.0.0",
              "lessThan": "4.14.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.15.0",
              "lessThan": "4.18.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.19.0",
              "lessThan": "4.20.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T18:47:48.609198Z",
          "id": "CVE-2026-40859",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.14.8",
              "matchCriteriaId": "7662EB25-EAB6-493F-924C-5CA8A6F462B4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15.0",
              "versionEndExcluding": "4.18.3",
              "matchCriteriaId": "0AEE4159-4465-4ACD-B94A-1E4682C85270"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDA4D206-8808-4D2A-873E-8488DD7E3E16"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-40859.html",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/05/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}