CVE-2026-43866 camel vulnerability
Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 hardening added a post-deserialization class check that rejects classes outside the default allow-list java.**;javax.**;org.apache.camel.**;!*. However org.apache.camel.support.DefaultExchangeHolder itself lives in the allow-listed org.apache.camel.** namespace, so an ObjectMessage whose top-level object is a DefaultExchangeHolder passes the check. The receiving side then calls DefaultExchangeHolder.unmarshal() on it without requiring the transferExchange option to be enabled - an asymmetric trust boundary, since the sending side gates ObjectMessage and transferExchange handling but the receiving side did not - writing every non-null field of the holder into the Exchange: the message body, the IN and OUT headers, the exchange properties, the variables, the exchange id and the exception. An attacker who can publish an ObjectMessage to a queue or topic consumed by an affected Camel application can therefore inject arbitrary Exchange state using only universally-trusted java.lang and java.util types, with no deserialization gadget chain required, to manipulate routing and headers, exchange properties and error handling. The same handling applies to camel-sjms and camel-sjms2, and to the JMS-family components built on JmsComponent and JmsBinding: camel-amqp, camel-activemq and camel-activemq6. This is a bypass of the CVE-2026-40860 fix rather than a flaw in it. This issue affects Apache Camel: from 3.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0; Apache Camel: from 3.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, JMS ObjectMessage handling is disabled by default in camel-jms, camel-sjms and the JMS-family components (a new objectMessageEnabled option defaults to false at the component and endpoint level), so an incoming ObjectMessage - including a DefaultExchangeHolder payload - is no longer deserialized unless the option is explicitly enabled; only set objectMessageEnabled=true when the consumed JMS destination is fed exclusively by trusted producers. For deployments that cannot upgrade immediately, restrict publish access to the queues and topics consumed by Camel to trusted producers via JMS broker authorization, and do not expose JMS consumers that map ObjectMessage bodies to untrusted networks; a JMS-provider deserialization allow-list does not mitigate this specific bypass because the crafted payload uses only universally-trusted classes.
Quick answer
apache camel should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2026-43866 affects Apache Camel JMS. Upgrade Apache Camel on the deployed branch to 4.14.8, 4.18.3, 4.21.0 and review any route that exposes this component to user-controlled messages, headers, files, or backend responses. Affected ranges in the local record are 3.0.0 through before 4.14.8; 4.15.0 through before 4.18.3; 4.19.0 through before 4.21.0.
- Inventory every service, route, integration runtime, container image, and dependency lockfile that includes Apache Camel JMS or related Camel modules.
- Compare deployed Camel versions with the affected ranges for CVE-2026-43866; prioritize internet-facing routes, message brokers, file parsers, and integrations that process untrusted input.
- Upgrade to 4.14.8, 4.18.3, 4.21.0, or to a later vendor-supported Camel release on the same branch.
- Rebuild application artifacts and container images from a clean dependency lockfile so vulnerable Camel modules are removed from direct and transitive dependencies.
- Harden route boundaries by filtering user-controlled Camel headers, component control headers, serialized objects, command arguments, paths, and backend response bodies before they reach Camel internals.
- Rotate credentials, tokens, queue secrets, and integration keys if the affected route could expose data, redirect backend requests, deserialize attacker-controlled objects, or execute unintended operations.
- Deploy first to staging, run regression tests for the impacted route, then promote to production with monitoring for route errors, deserialization events, SSRF indicators, unexpected command arguments, and authorization failures.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm dependency output shows Apache Camel 4.14.8, 4.18.3, 4.21.0 or a later fixed release in every affected application.
- Replay malicious or unexpected headers, serialized payloads, paths, files, command arguments, and backend responses against the affected route and verify they are rejected or sanitized.
- Check application logs after deployment for exceptions, leaked stack traces, SSRF attempts, command execution anomalies, unauthorized backend operations, or unexpected route destinations.
- Open the generated Fixnx page and confirm the canonical URL ends with camel-cve-2026-43866.
- Re-run sitemap validation and confirm camel-cve-2026-43866 appears once in sitemap.xml with the full CVE-2026-43866 suffix.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-43866?
apache camel should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.