Description
Deserialization of Untrusted Data vulnerability in Apache Camel.

The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a man-in-the-middle position on an unencrypted (plain HTTP) connection, or by compromising the backend service - can return a crafted serialized Java object and, if a suitable gadget chain is present on the classpath, achieve remote code execution on the Camel application host. The path is not reachable in the default configuration, where transferException is false.
This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the deserialization performed by both helper utilities is constrained by a default ObjectInputFilter (allow-list java.**;javax.**;org.apache.camel.**;!*), which can be customised through the new deserializationFilter endpoint option or the JVM-wide -Djdk.serialFilter system property. For deployments that cannot upgrade immediately: do not enable transferException=true (or allowJavaSerializedObject=true) on producers that talk to untrusted or network-reachable backends; ensure producer connections use TLS (https) so that a response cannot be substituted by a man-in-the-middle; and, where the option is required, set an explicit -Djdk.serialFilter allow-list (for example java.**;org.apache.camel.**;!*) to constrain deserialization.
Published: 2026-07-06
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The camel-vertx-http component of Apache Camel reads HTTP response bodies with the Content-Type application/x-java-serialized-object and deserializes them using a raw java.io.ObjectInputStream. This raw deserialization path is activated only when the producer endpoint is configured with transferException=true (or allowJavaSerializedObject=true) and the default throwExceptionOnFailure=true. When a backend returns a 5xx response that includes a serialized Java object, Camel deserializes it without applying any ObjectInputFilter, creating a classic deserialization-of-untrusted-data vulnerability identified as CWE-502.

Affected Systems

Apache Camel versions 4.0.0 through 4.14.8 (exclusive), 4.15.0 through 4.18.3 (exclusive), and 4.19.0 through 4.20.0 (exclusive) are affected. Any deployment using the camel-vertx-http component in these releases that has enabled transferException=true (or allowJavaSerializedObject=true) is vulnerable. The problem does not exist in earlier Camel releases or in versions beyond 4.20.0 that do not contain this code path.

Risk and Exploitability

Based on the description, the likely attack vector requires an attacker who can supply a crafted serialized Java object to a Camel producer. Commonly, this can be achieved by compromising the back-end service that Camel calls or by intercepting an unencrypted HTTP connection and replacing the 5xx response with a malicious payload. Once the unsanitized deserialization occurs, a gadget chain present on the classpath can execute arbitrary code on the Camel host. The CVSS score of 8.1 indicates high severity, and while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, the potential for remote code execution demands immediate attention.

Generated by OpenCVE AI on July 26, 2026 at 20:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Apache Camel 4.20.0; if on the 4.14.x LTS stream upgrade to 4.14.8; if on the 4.18.x stream upgrade to 4.18.3.
  • Disable the transferException=true or allowJavaSerializedObject=true options on producers that communicate with untrusted or network‑reachable backends.
  • Ensure producer connections use TLS (HTTPS); if TLS cannot be used, configure an explicit jdk.serialFilter allow‑list (for example java.*;org.apache.camel.*;!*) or set the deserializationFilter endpoint option to constrain deserialization.

Generated by OpenCVE AI on July 26, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache camel
Vendors & Products Apache
Apache camel

Mon, 06 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a man-in-the-middle position on an unencrypted (plain HTTP) connection, or by compromising the backend service - can return a crafted serialized Java object and, if a suitable gadget chain is present on the classpath, achieve remote code execution on the Camel application host. The path is not reachable in the default configuration, where transferException is false. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the deserialization performed by both helper utilities is constrained by a default ObjectInputFilter (allow-list java.**;javax.**;org.apache.camel.**;!*), which can be customised through the new deserializationFilter endpoint option or the JVM-wide -Djdk.serialFilter system property. For deployments that cannot upgrade immediately: do not enable transferException=true (or allowJavaSerializedObject=true) on producers that talk to untrusted or network-reachable backends; ensure producer connections use TLS (https) so that a response cannot be substituted by a man-in-the-middle; and, where the option is required, set an explicit -Djdk.serialFilter allow-list (for example java.**;org.apache.camel.**;!*) to constrain deserialization.
Title Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
Weaknesses CWE-502
References

Subscriptions

Apache Camel
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-06T18:48:16.623Z

Reserved: 2026-04-15T12:20:24.037Z

Link: CVE-2026-40859

cve-icon Vulnrichment

Updated: 2026-07-06T09:25:02.059Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-06T07:54:29Z

Links: CVE-2026-40859 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:00:04Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data