CVE-2026-40859: Apache Camel RCE via Deserialization in Vertx and Netty HTTP components

CVE-2026-40859 · Severity: high · CVSS 8.1 · Published 2026-07-06

Apache Camel's HTTP components (Vertx-Http and Netty-Http) contain a critical flaw that allows remote code execution when processing HTTP responses from untrusted backend services. When the transferException option is enabled, the components deserialize Java objects from response bodies without proper validation, potentially allowing attackers to inject malicious code. This affects applications that communicate with compromised or attacker-controlled servers over unencrypted HTTP connections.

Technologies: org.apache.camel:camel-netty-http (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-40859 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40859 being exploited in the wild.
How severe is CVE-2026-40859?
High severity, with a CVSS score of 8.1, published 6 July 2026.
Which products and versions are affected?
Apache Camel Netty-Http 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.19.x; Apache Camel Vertx-Http 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.19.x; org.apache.camel:camel-netty-http (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8; org.apache.camel:camel-vertx-http (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8.
Is there a fix for CVE-2026-40859?
Yes. org.apache.camel:camel-netty-http (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-vertx-http (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40859 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-40859?
Check whether you run Apache Camel Netty-Http, Apache Camel Vertx-Http, org.apache.camel:camel-netty-http (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-netty-http (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-netty-http to 4.14.8 in your pom.xml or build.gradle
  • org.apache.camel:camel-vertx-http (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-vertx-http to 4.14.8 in your pom.xml or build.gradle

Technical details

The vulnerability is a Java deserialization flaw (CWE-502) in the VertxHttpHelper and NettyHttpHelper components. When deserializing HTTP response bodies with Content-Type application/x-java-serialized-object, the code uses a raw java.io.ObjectInputStream without applying an ObjectInputFilter, allowing instantiation of arbitrary classes. The attack path is reachable only when the producer endpoint is configured with transferException=true (or component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default true value. An attacker who controls the backend HTTP service—either through a man-in-the-middle attack on unencrypted HTTP or by compromising the backend—can return a crafted serialized Java object. If a suitable gadget chain exists on the classpath, this achieves arbitrary remote code execution. Patches in versions 4.14.8, 4.18.3, and 4.20.0 add ObjectInputFilter constraints with an allowlist (java.**, javax.**, org.apache.camel.**, !*) and introduce a new deserializationFilter endpoint option for customization.

Affected products

  • Apache Camel Vertx-Http 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.19.x
  • Apache Camel Netty-Http 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.19.x

Identifiers

  • CVE-2026-40859
  • GHSA-6qw3-4796-5984

Timeline

  • 2026-07-06: disclosed: Vulnerability disclosed in GHSA-6qw3-4796-5984 and CVE-2026-40859
  • 2026-07-06: patched: Patches released: Camel 4.14.8, 4.18.3, and 4.20.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.