CVE-2026-40860

설명

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the c...

영향 제품·버전

제품 Apache Software Foundation Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

영향 버전 Apache Software Foundation Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 >= 3.0.0 < 4.14.7, >= 4.15.0 < 4.18.2, >= 4.19.0 < 4.20.0, 4.19.0

수정 버전 Apache Software Foundation Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 4.14.7, 4.18.2

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE CWE-502

EPSS 데이터 기준일 2026.08.04