CVE-2026-42527

{
  "id": "CVE-2026-42527",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T09:16:35.657",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deserialization of Untrusted Data vulnerability in Apache Camel.\n\nThe default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. The class-level filter check passes because the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository).\nThis issue affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not include javax.**)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de deserialización de datos no confiables en Apache Camel.\n\nEl patrón ObjectInputFilter predeterminado que se envía con varios componentes de Apache Camel para el filtrado de deserialización de defensa en profundidad (’java.;javax.;org.apache.camel.**;!*’, o la variante sin ’javax.’ en los componentes de repositorio de agregación) utiliza un glob recursivo ’java.’ que admite clases cuyos métodos hashCode/equals/readObject realizan E/S de red, notablemente java.net.URL y java.net.InetAddress. Cuando un atacante puede entregar una carga útil serializada en Java a un consumidor de Camel afectado, la deserialización de un HashMap (o cualquier colección que llame a hashCode en sus elementos) que contiene claves java.net.URL hace que la JVM emita consultas DNS al host proporcionado por el atacante durante el efecto secundario de la deserialización. La verificación del filtro a nivel de clase pasa porque la clase del objeto resultante (HashMap) está en la lista de permitidos; la consulta DNS es observable en un servidor DNS controlado por el atacante, proporcionando un canal lateral fuera de banda. La exposición es mayor en la familia camel-jms porque JmsBinding.extractBodyFromJms invoca ObjectMessage.getObject() incondicionalmente cuando mapJmsMessage=true (predeterminado). Componentes afectados: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-HTTP, camel-vertx-HTTP, camel-infinispan, y los componentes de repositorio de agregación camel-leveldb, camel-cassandraql, camel-consul, camel-sql (repositorio de agregación JDBC).\nEste problema afecta a Apache Camel: desde 4.14.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a una versión que contenga la corrección CAMEL-23372 una vez disponible: 4.21.0 para la línea 4.21.x, 4.18.3 para la línea 4.18.x y 4.14.8 para la línea 4.14.x. Para implementaciones que no pueden actualizarse inmediatamente, configure una lista de permitidos del lado del proveedor de JMS (Apache ActiveMQ Artemis ’deserializationAllowList’ / ’deserializationDenyList’, Apache ActiveMQ Classic ’org.apache.activemq.SERIALIZABLE_PACKAGES’) como la mitigación principal, y/o anule el valor predeterminado en el código a través de la opción ’deserializationFilter’ a nivel de endpoint o la propiedad del sistema ’-Djdk.serialFilter’ a nivel de JVM con una denegación explícita: ’!java.net.;java.;javax.;org.apache.camel.;!*’ (o ’!java.net.;java.;org.apache.camel.**;!*’ para los componentes de repositorio de agregación, que no incluyen javax.**)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.camel:camel",
          "versions": [
            {
              "version": "4.14.0",
              "lessThan": "4.14.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.15.0",
              "lessThan": "4.18.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.19.0",
              "lessThan": "4.21.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T18:47:03.658679Z",
          "id": "CVE-2026-42527",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.14.0",
              "versionEndExcluding": "4.14.8",
              "matchCriteriaId": "58BD2573-EEBB-4D76-B3B7-038A53515204"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.18.0",
              "versionEndExcluding": "4.18.3",
              "matchCriteriaId": "3F672322-AA52-4621-B687-76B5AC9D619F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:4.20.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "526A7504-CAAA-43DD-97B2-8A18093E97C9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-42527.html",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/05/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}