Executive brief
Apache Camel's JMS integration components (camel-jms, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6) deserialize untrusted JMS ObjectMessage payloads without validation, allowing an attacker to publish a crafted message to a queue or topic that achieves remote code execution when a suitable gadget chain is present. This affects Camel applications consuming JMS messages with the default mapJmsMessage option enabled, creating a critical remote code execution vulnerability accessible to anyone with publish access to the message broker.
Technical details
The vulnerability exists in JmsBinding.extractBodyFromJms() and equivalent classes across multiple Camel JMS components, which call javax.jms.ObjectMessage.getObject() to deserialize incoming message payloads without applying ObjectInputFilter, allowlist, or denylist controls. The vulnerable code path is reached whenever the mapJmsMessage option is enabled (the default behavior) and Camel acts as a JMS consumer. An attacker with access to publish messages to a JMS queue or topic can craft a malicious ObjectMessage payload containing a serialized gadget chain; when the Camel consumer deserializes this payload, the gadget chain executes arbitrary code with the privileges of the Camel application. The vulnerability affects camel-jms, camel-sjms, camel-sjms2, and camel-amqp directly, and transitively impacts camel-activemq and camel-activemq6. Patches are available in versions 4.14.7, 4.18.2, and 4.20.0.
Affected products
- Apache Camel JMS 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
- Apache Camel SJMS 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
- Apache Camel SJMS2 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
- Apache Camel AMQP 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
- Apache Camel ActiveMQ 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
- Apache Camel ActiveMQ6 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
Timeline
- 2026-04-27: disclosed: Public disclosure via GitHub Advisory Database and NVD
- 2026-04-27: patched: Patches available in versions 4.14.7, 4.18.2, and 4.20.0