org.apache.camel:camel-amqp

3 results · Feed

• High 7.3
  CVE-2026-43866 Public exploit

  Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

  Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms…

  Apache Software Foundation Apache Camel org.apache.camel:camel-sjms org.apache.camel:camel-jms Maven
  Jul 6, 2026
• High 8.1
  CVE-2026-42527 Public exploit

  Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**'…

  Apache Software Foundation Apache Camel org.apache.camel:camel-jms org.apache.camel:camel-sjms Maven
  Jul 6, 2026
• Critical 9.8
  CVE-2026-40860 Public exploit

  Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

  JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or c…

  Apache Software Foundation Apache Camel org.apache.camel:camel-jms org.apache.camel:camel-sjms Maven
  Apr 27, 2026