Review reviewHigh

CVE-2026-40048

Apache Software Foundation Apache Camel PQC, Red Hat build of Apache Camel for Spring Boot 4, camel

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the v...

CVSS: 7.8
EPSS: 0.25%
CISA KEV: Not listed
Published: 2026.04.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.25%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Camel PQC, Red Hat build of Apache Camel for Spring Boot 4, camel
Affected versions: >= 4.19.0 < 4.20.0, >= 4.18.0 < 4.18.2, 4.19.0
Fixed versions: 4.18.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Camel PQC, Red Hat build of Apache Camel for Spring Boot 4, camel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502