# CVE-2026-42527: Apache Camel information disclosure via insecure deserialization filter

Source: https://junglewise.ai/threats/cve-2026-42527-apache-camel-information-disclosure-via-insecure-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-42527 · Severity: high · CVSS 8.1 · Published 2026-07-06

Apache Camel is an open-source integration framework that processes and routes messages between systems using pluggable components. Multiple Camel components use a deserialization security filter that is too permissive, allowing attackers who can send serialized messages to trigger unwanted DNS lookups and leak information about the target system. This affects message queue consumers (JMS, AMQP) and storage repositories, potentially allowing attackers to confirm vulnerable deployments or exfiltrate data through DNS side channels.

Technologies: [Apache Camel](https://junglewise.ai/threats/technologies/camel), [Apache Camel JMS](https://junglewise.ai/threats/technologies/camel-jms), [Apache Camel SJMS](https://junglewise.ai/threats/technologies/camel-sjms), [org.apache.camel:camel-amqp (Maven)](https://junglewise.ai/threats/technologies/org-apache-camel-camel-amqp), [org.apache.camel:camel-infinispan (Maven)](https://junglewise.ai/threats/technologies/org-apache-camel-camel-infinispan), [org.apache.camel:camel-jms (Maven)](https://junglewise.ai/threats/technologies/org-apache-camel-camel-jms), [org.apache.camel:camel-netty-http (Maven)](https://junglewise.ai/threats/technologies/org-apache-camel-camel-netty-http), [org.apache.camel:camel-sjms (Maven)](https://junglewise.ai/threats/technologies/org-apache-camel-camel-sjms). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-42527 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42527 being exploited in the wild.

**How severe is CVE-2026-42527?** High severity, with a CVSS score of 8.1, published 6 July 2026.

**Which products and versions are affected?** Apache Camel 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x; org.apache.camel:camel-amqp (Maven) ECOSYSTEM:introduced=4.14.0,fixed=4.14.8; org.apache.camel:camel-cassandraql (Maven) ECOSYSTEM:introduced=4.14.0,fixed=4.14.8; org.apache.camel:camel-consul (Maven) ECOSYSTEM:introduced=4.14.0,fixed=4.14.8; and 9 more.

**Is there a fix for CVE-2026-42527?** Yes. org.apache.camel:camel-amqp (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-cassandraql (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-consul (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-infinispan (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-jms (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-leveldb (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-mina (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-netty (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-netty-http (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-sjms (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-sql (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-vertx-http (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42527 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42527?** Check whether you run Apache Camel, Apache Camel CassandraQL, Apache Camel Consul or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.camel:camel-amqp (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-amqp to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-cassandraql (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-cassandraql to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-consul (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-consul to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-infinispan (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-infinispan to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-jms (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-jms to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-leveldb (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-leveldb to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-mina (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-mina to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-netty (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-netty to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-netty-http (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-netty-http to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-sjms (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-sjms to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-sql (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-sql to 4.14.8 in your pom.xml or build.gradle
  ```

- org.apache.camel:camel-vertx-http (Maven): upgrade to 4.14.8 or later

  ```sh
  # set org.apache.camel:camel-vertx-http to 4.14.8 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability stems from an overly broad ObjectInputFilter pattern ('java.**;javax.**;org.apache.camel.**;!*') that allows classes within the java.** namespace, including java.net.URL and java.net.InetAddress. When a HashMap or similar collection with java.net.URL keys is deserialized, the JVM calls hashCode() during reconstruction, triggering DNS resolution of the attacker-controlled hostname. The class-level filter passes because HashMap is allow-listed; the DNS query is the actual attack payload, observable on attacker infrastructure. The JMS consumer is most critical because JmsBinding.extractBodyFromJms() unconditionally deserializes ObjectMessage payloads by default (mapJmsMessage=true). Affected versions are 4.14.0–4.14.8, 4.15.0–4.18.3, and 4.19.0–4.21.0. Patches are available in 4.14.8, 4.18.3, and 4.21.0; mitigations include configuring message broker allow-lists or applying the JVM-wide serial filter with explicit '!java.net.**' deny rules.

## Affected products

- Apache Camel 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-jms) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-sjms) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-amqp) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-mina) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-netty) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-netty-http) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-vertx-http) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-infinispan) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-leveldb) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-cassandraql) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-consul) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x
- Apache Camel (camel-sql) 4.14.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x

## Identifiers

- CVE-2026-42527
- GHSA-8h6p-jvhf-9hcr

## Timeline

- 2026-07-06: disclosed
- 2026-07-06: patched: Patches released: 4.14.8, 4.18.3, 4.21.0

## References

- [https://api.github.com/users/oscerd](https://api.github.com/users/oscerd)
- [https://github.com/oscerd](https://github.com/oscerd)
- [https://api.github.com/users/oscerd/gists%7B/gist_id%7D](https://api.github.com/users/oscerd/gists%7B/gist_id%7D)
- [https://api.github.com/users/oscerd/repos](https://api.github.com/users/oscerd/repos)
- [https://avatars.githubusercontent.com/u/5106647?v=4](https://avatars.githubusercontent.com/u/5106647?v=4)
- [https://api.github.com/users/oscerd/events%7B/privacy%7D](https://api.github.com/users/oscerd/events%7B/privacy%7D)

## Related threats

- [Apache Camel SSRF in A2A webhook validator](https://junglewise.ai/threats/cve-2026-71569-server-side-request-forgery-ssrf-vulnerability-in-apache-camel)
- [Apache Camel OAuth component cache containing sensitive information](https://junglewise.ai/threats/cve-2026-94386-use-of-cache-containing-sensitive-information-vulnerability-in)
- [Apache Camel Saxon component XXE in XQuery evaluation](https://junglewise.ai/threats/cve-2026-90885-improper-restriction-of-xml-external-entity-reference)
- [Apache Camel AWS2-S3 expression language injection in key handling](https://junglewise.ai/threats/cve-2026-95664-improper-neutralization-of-special-elements-used-in-an-expression)
- [Apache Camel Keycloak security policy token expiration bypass](https://junglewise.ai/threats/cve-2026-95663-insufficient-session-expiration-vulnerability-in-apache-camel)