CVE-2026-40473

Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

Published Apr 27, 2026 CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Description

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject().

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Analysis

Technical impact

The Apache Camel Mina component contains an unsafe deserialization flaw in MinaConverter.toObjectInput(IoBuffer), which wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class‑loading restrictions. When a Camel route consumes a MINA stream and requests conversion to ObjectInput, the unfiltered ObjectInputStream deserializes a maliciously crafted Java object, potentially executing arbitrary code during readObject(). This vulnerability is classified as CWE-502 and can compromise the confidentiality, integrity, and availability of the affected system.

Affected Systems

The vulnerability affects Apache Software Foundation’s Apache Camel Mina product. All Camel releases from 3.0.0 up to but not including 4.14.6, from 4.15.0 up to but not including 4.18.2, and from 4.19.0 up to but not including 4.20.0 are impacted. Users on the 4.14.x LTS branches before 4.14.6 and on the 4.18.x releases before 4.18.2 are also affected.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% reflects a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can reach the vulnerable component via a TCP or UDP consumer port exposed to the network, send a crafted serialized payload, and trigger code execution with no additional prerequisites. The attack can be performed remotely against any publicly reachable or locally accessible consumer ports.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Camel Mina

unaffected

Version	Status	Constraints
`3.0.0`	affected	< 4.14.6
`4.15.0`	affected	< 4.18.2
`4.19.0`	affected	< 4.20.0

Configuration 1 [-]

OR	cpe:2.3:a:apache:camel::::::::
	cpe:2.3:a:apache:camel::::::::
	cpe:2.3:a:apache:camel:4.19.0:::::::*

No data.

Vendor Product Versions

Apache

Camel

Version	Status	Scheme	Platform
`[3.0.0,4.14.6)`	affected	semver	—
`[4.15.0,4.18.2)`	affected	semver	—
`[4.19.0,4.20.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache Camel Mina to version 4.20.0, which includes the deserialization patch.
If the system is on the 4.14.x LTS branch, upgrade to 4.14.6; if on the 4.18.x releases, upgrade to 4.18.2.
Temporarily disable the Camel route that consumes Mina streams or block inbound traffic on the vulnerable port until a patch is applied.
Implement network segmentation or host‑based firewall rules to limit access to the MINA consumer port, reducing the attack surface while the upgrade is pending.

Generated by OpenCVE AI on April 28, 2026 at 13:09 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vpr3-2659-rw55	Camel-MINA Vulnerable to Deserialization of Untrusted Data

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.2% (1.188% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/04/26/8
https://access.redhat.com/security/cve/CVE-2026-40473
https://bugzilla.redhat.com/show_bug.cgi?id=2463180
https://camel.apache.org/security/CVE-2026-40473.html
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40473.json

History

Apr 28, 2026 7:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:camel:::::::: cpe:2.3:a:apache:camel:4.19.0:::::::*

Apr 28, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache camel
Vendors & Products		Apache Apache camel

Apr 27, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 27, 2026 9:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/04/26/8

Apr 27, 2026 9:15 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject(). This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Title		Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP
Weaknesses		CWE-502
References		https://camel.apache.org/security/CVE-2026-40473.html