CVE-2026-43866 high CVSS 7.3

Unsafe Deserialization in org.apache.camel:camel-jms (CVE-2026-43866)

Summary

Vulnerability in org.apache.camel:camel-jms (CVE-2026-43866). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.21.0 or later.

Original description

The description as published by the source.

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component.

JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 hardening added a post-deserialization class check that rejects classes outside the default allow-list java.;javax.;org.apache.camel.;!*. However org.apache.camel.support.DefaultExchangeHolder itself lives in the allow-listed org.apache.camel. namespace, so an ObjectMessage whose top-level object is a DefaultExchangeHolder passes the check. The receiving side then calls DefaultExchangeHolder.unmarshal() on it without requiring the transferExchange option to be enabled - an asymmetric trust boundary, since the sending side gates ObjectMessage and transferExchange handling but the receiving side did not - writing every non-null field of the holder into the Exchange: the message body, the IN and OUT headers, the exchange properties, the variables, the exchange id and the exception. An attacker who can publish an ObjectMessage to a queue or topic consumed by an affected Camel application can therefore inject arbitrary Exchange state using only universally-trusted java.lang and java.util types, with no deserialization gadget chain required, to manipulate routing and headers, exchan…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-43866 has been found in org.apache.camel:camel-jms.
Risk of unauthorized operations or information disclosure. CVSS score: 7.3/10.
What to do: upgrade org.apache.camel:camel-jms to 4.21.0 or later.
If unsure, ask your IT team or search "org.apache.camel:camel-jms CVE-2026-43866" on the vendor's site.

CVE-2026-43866 (org.apache.camel:camel-jms) — CWE-502 / CVSS v3 7.3
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 4.21.0 — apply immediately
Workaround: set objectMessage: Enabled
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Unsafe deserialization (CWE-502) exists in org.apache.camel:camel-jms.

📍 Affected scope

Check the vendor advisory for the affected versions of org.apache.camel:camel-jms.

🔥 Severity

Severity: High (CVSS 7.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 4.21.0.

🛡️ Workaround

Workaround: set objectMessage: Enabled

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
資産台帳・SBOM・依存マニフェストで org.apache.camel:camel-jms を使っているサービスとバージョンを洗い出す。
2
Apply temporary workaround mitigate
```
set objectMessage: Enabled
```
パッチが適用されるまでの応急処置として、set objectMessage: Enabled を実施。回避策の副作用 (機能低下) を確認した上で。
3
Apply patch patch
```
Upgrade org.apache.camel:camel-jms to 4.21.0
```
ステージング環境で 4.21.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
4
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。