Deserialization of Untrusted Data in Apache Camel - CVE-2026-42527

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to deserialization of untrusted data in the ObjectInputFilter-based deserialization handling of affected Camel consumers when processing attacker-supplied Java-serialized payloads. A remote attacker can send a specially crafted serialized object containing java.net.URL keys to disclose sensitive information.

The issue can trigger outbound DNS queries to an attacker-controlled host as a deserialization side effect, creating an out-of-band information disclosure channel. Exposure is highest in the camel-jms family when ObjectMessage payloads are deserialized with the default mapJmsMessage setting enabled.

Affected software

How to mitigate CVE-2026-42527

External References

• https://lists.apache.org/api/email.lua?id=5395mh5lwvvv8b88k0tw0tj8jb3hj4wc
• https://camel.apache.org/security/CVE-2026-42527.html

Related Security Bulletins

• Multiple vulnerabilities in Apache Camel