The Apache Camel Mina component contains an unsafe deserialization flaw in MinaConverter.toObjectInput(IoBuffer), which wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class‑loading restrictions. When a Camel route consumes a MINA stream and requests conversion to ObjectInput, the unfiltered ObjectInputStream deserializes a maliciously crafted Java object, potentially executing arbitrary code during readObject(). This vulnerability is classified as CWE-502 and can compromise the confidentiality, integrity, and availability of the affected system.

The vulnerability affects Apache Software Foundation’s Apache Camel Mina product. All Camel releases from 3.0.0 up to but not including 4.14.6, from 4.15.0 up to but not including 4.18.2, and from 4.19.0 up to but not including 4.20.0 are impacted. Users on the 4.14.x LTS branches before 4.14.6 and on the 4.18.x releases before 4.18.2 are also affected.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% reflects a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can reach the vulnerable component via a TCP or UDP consumer port exposed to the network, send a crafted serialized payload, and trigger code execution with no additional prerequisites. The attack can be performed remotely against any publicly reachable or locally accessible consumer ports.