Executive brief
Apache Camel is an open-source integration framework that processes and routes messages between systems using pluggable components. Multiple Camel components use a deserialization security filter that is too permissive, allowing attackers who can send serialized messages to trigger unwanted DNS lookups and leak information about the target system. This affects message queue consumers (JMS, AMQP) and storage repositories, potentially allowing attackers to confirm vulnerable deployments or exfiltrate data through DNS side channels.
Technical details
The vulnerability stems from an overly broad ObjectInputFilter pattern ('java.**;javax.**;org.apache.camel.**;!*') that allows classes within the java.** namespace, including java.net.URL and java.net.InetAddress. When a HashMap or similar collection with java.net.URL keys is deserialized, the JVM calls hashCode() during reconstruction, triggering DNS resolution of the attacker-controlled hostname. The class-level filter passes because HashMap is allow-listed; the DNS query is the actual attack payload, observable on attacker infrastructure. The JMS consumer is most critical because JmsBinding.extractBodyFromJms() unconditionally deserializes ObjectMessage payloads by default (mapJmsMessage=true). Affected versions are 4.14.0–4.14.8, 4.15.0–4.18.3, and 4.19.0–4.21.0. Patches are available in 4.14.8, 4.18.3, and 4.21.0; mitigations include configuring message broker allow-lists or applying the JVM-wide serial filter with explicit '!java.net.**' deny rules.
Affected products
- Apache Camel 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-jms) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-sjms) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-amqp) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-mina) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-netty) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-netty-http) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-vertx-http) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-infinispan) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-leveldb) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-cassandraql) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-consul) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-sql) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
Timeline
- 2026-07-06: disclosed
- 2026-07-06: patched: Patches released: 4.14.8, 4.18.3, 4.21.0