CVE-2026-40860: Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
CVE-2026-40860 affects the JMS binding code of Apache Camel, which deserializes incoming JMS ObjectMessage payloads without any class filter. The CNA rates it critical, and the record describes possible remote code execution when a gadget chain is present on the classpath. Upgrading to a fixed release is the main remediation.
Overview
The JMS-family components of Apache Camel, including camel-jms, camel-sjms, camel-sjms2, camel-amqp and other components built on JmsComponent, deserialize the body of incoming JMS ObjectMessage values without an ObjectInputFilter, class allowlist or class denylist. The CVE record classifies the weakness as CWE-502, Deserialization of Untrusted Data.
Impact
The record describes possible remote code execution when a deserialization gadget chain is present on the application classpath. The attacker needs to be able to publish a crafted ObjectMessage to a queue or topic that a Camel application consumes. The CNA rates the issue critical with a CVSS base score of 9.8 and a network attack vector that requires no privileges and no user interaction.
Affected products and versions
- Apache Camel from 3.0.0 before 4.14.7
- Apache Camel from 4.15.0 before 4.18.2
- Apache Camel from 4.19.0 before 4.20.0
The affected code path is reached when the mapJmsMessage option is enabled, which is the default, and Camel acts as a JMS consumer. The record also states that camel-sjms2, camel-amqp, camel-activemq and camel-activemq6 reach the same handling through their class hierarchy.
Exploitation status
The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted for this analysis. The EPSS probability in the record is 0.01534, which is a modelled score and not a confirmation of exploitation.
Remediation and mitigation
- Upgrade Apache Camel to 4.20.0, which the record identifies as the fixed release.
- Users on the 4.14.x LTS stream should move to 4.14.7, and users on the 4.18.x stream should move to 4.18.2.
- Review every JMS-family component in use, including indirect use through camel-sjms2, camel-amqp and ActiveMQ-based components, because they share the affected handling.
- Restrict which producers can write to consumed queues and topics, and review broker access controls.
- Inference: if the mapJmsMessage option is not needed by a route, disabling it may avoid the affected code path, but this should be validated against the vendor advisory before relying on it.
Detection guidance
- Inventory applications that depend on camel-jms, camel-sjms, camel-sjms2, camel-amqp or JMS components built on JmsComponent, and record their Camel versions.
- Monitor JMS brokers for unexpected ObjectMessage traffic from producers that are not expected to send serialized objects.
- Review application logs for deserialization errors or unexpected class-loading messages on JMS consumers.
Limitations of the available information
The record's fixes field is empty, so the fixed versions are taken from the description and the affected version ranges, not from a structured fix list. The affected list also contains a separate entry for version 4.19.0 that overlaps with the range entry. A second scoring provider reports 7.5 instead of 9.8. No proof-of-concept details or exploitation telemetry are present in the record.
Frequently asked questions
Is CVE-2026-40860 known to be exploited in the wild?
The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted for this analysis.
Which Apache Camel version fixes the issue?
The record recommends upgrading to 4.20.0. Users on the 4.14.x LTS stream should use 4.14.7, and users on the 4.18.x stream should use 4.18.2.
Does the issue affect components other than camel-jms?
The record states that camel-sjms, camel-sjms2, camel-amqp and other JMS-family components built on JmsComponent reach the same handling.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.