CVE-2026-40860

The JmsBinding.extractBodyFromJms() method in the camel-jms and camel-sjms modules calls javax.jms.ObjectMessage.getObject() to deserialize the payload of incoming JMS ObjectMessage type messages without applying input filters (ObjectInputFilter), allowlists, or blocklists. This path is reached by default when the mapJmsMessage option is enabled (default value) and the Camel application operates as a JMS consumer. An attacker with the ability to publish messages to a queue or topic handled by such an application can deliver a crafted payload exploiting any deserialization gadget chain present on the classpath. The issue also affects the camel-sjms2, camel-amqp, camel-activemq, and camel-activemq6 components, which indirectly use vulnerable JmsBinding classes.

Successful exploitation of the vulnerability allows an unauthenticated attacker to remotely execute arbitrary code (RCE) in the context of the Apache Camel application process, which can lead to complete server compromise, data leakage, or service availability disruption.

Apache Camel should be updated to version 4.20.0 (recommended). Users of the LTS 4.14.x branch should update to version 4.14.7. Users of the 4.18.x branch should update to version 4.18.2. As a temporary workaround, consider disabling the mapJmsMessage option or restricting access to JMS queues and topics exclusively to trusted senders.

Apache Camel in versions: from 3.0.0 to (excluding) 4.14.7, from 4.15.0 to (excluding) 4.18.2, and from 4.19.0 to (excluding) 4.20.0. Affects components: camel-jms, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6.