CVE-2026-43866
Description
A flaw was found in Apache Camel JMS components. A remote attacker can exploit a deserialization vulnerability by sending a specially crafted ObjectMessage to a queue or topic consumed by an affected Camel application. This bypasses existing security checks, allowing the attacker to inject arbitrary Exchange state. This injection can lead to the manipulation of routing, headers, exchange properties, and error handling within the application.
Statement
A flaw was found in the Apache Camel JMS components. The JmsBinding.extractBodyFromJms() method deserializes incoming JMS ObjectMessage payloads when the mapJmsMessage option is enabled (the default). The prior fix for CVE-2026-40860 can be bypassed using a crafted ObjectMessage containing a DefaultExchangeHolder, which resides within the allowed org.apache.camel namespace. Once deserialized, it injects arbitrary Exchange state including message body, headers, and properties without requiring any deserialization gadget chain. Red Hat builds of Apache Camel for Spring Boot and Quarkus ship the affected camel-jms and camel-amqp components.
Mitigation
Restrict publish access to JMS queues and topics consumed by Camel applications via broker authorization. Note that a JMS-provider deserialization allow-list does not mitigate this specific bypass because the crafted payload uses only universally-trusted classes within the org.apache.camel namespace.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 7.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | Low |
| Integrity Impact | High | N/A | Low |
| Availability Impact | None | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data; Unexpected State
Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.
Availability
Technical Impact: DoS: Resource Consumption (CPU)
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.
Other
Technical Impact: Varies by Context
The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform unauthorized actions, such as generating a shell.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
