CVE-2026-43866: Apache Camel deserialization filter bypass in JMS components

CVE-2026-43866 · Severity: high · CVSS 7.3 · Published 2026-07-06

Apache Camel's JMS components contain a vulnerability that allows attackers to bypass security filters protecting against malicious serialized objects. An attacker who can send messages to a JMS queue or topic consumed by a vulnerable Camel application can inject malicious Exchange state to manipulate message routing, modify headers, or trigger error handlers—potentially leading to unauthorized actions, data modification, or service disruption. This is a bypass of a previous security patch and affects multiple Camel integration components.

Technologies: Apache Camel JMS, Apache Camel SJMS, org.apache.camel:camel-amqp (Maven), org.apache.camel:camel-jms (Maven), org.apache.camel:camel-sjms (Maven). Vendors: Apache, Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-43866 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43866 being exploited in the wild.
How severe is CVE-2026-43866?
High severity, with a CVSS score of 7.3, published 6 July 2026.
Which products and versions are affected?
Apache Camel ActiveMQ6 >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0; Apache Camel JMS >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0; Apache Camel SJMS >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0; Apache Camel SJMS2 >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0; and 8 more.
Is there a fix for CVE-2026-43866?
Yes. org.apache.camel:camel-activemq (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-activemq6 (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-amqp (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-jms (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-sjms (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-sjms2 (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43866 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-43866?
Check whether you run Apache Camel ActiveMQ6, Apache Camel JMS, Apache Camel SJMS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-activemq (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-activemq to 4.14.8 in your pom.xml or build.gradle
  • org.apache.camel:camel-activemq6 (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-activemq6 to 4.14.8 in your pom.xml or build.gradle
  • org.apache.camel:camel-amqp (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-amqp to 4.14.8 in your pom.xml or build.gradle
  • org.apache.camel:camel-jms (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-jms to 4.14.8 in your pom.xml or build.gradle
  • org.apache.camel:camel-sjms (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-sjms to 4.14.8 in your pom.xml or build.gradle
  • org.apache.camel:camel-sjms2 (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-sjms2 to 4.14.8 in your pom.xml or build.gradle

Technical details

This is a deserialization bypass vulnerability in JmsBinding.extractBodyFromJms() and equivalent code in camel-sjms. When mapJmsMessage is enabled (the default), incoming JMS ObjectMessages are deserialized. A prior CVE-2026-40860 hardening added a class allow-list (java.**, javax.**, org.apache.camel.**), but the vulnerable code itself—DefaultExchangeHolder—lives in the allow-listed org.apache.camel.** namespace. An attacker can craft an ObjectMessage containing a DefaultExchangeHolder that passes the security check; upon deserialization, the receiving side calls DefaultExchangeHolder.unmarshal() without requiring the transferExchange option, creating an asymmetric trust boundary. This allows injection of arbitrary Exchange state (message body, headers, properties, variables, exchange ID, exception) using only universally-trusted java.lang and java.util types, with no gadget chain required. The vulnerability affects camel-jms, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, and camel-activemq6. Patches are available: version 4.21.0, 4.18.3, or 4.14.8 depending on the release stream; after patching, ObjectMessage handling is disabled by default (objectMessageEnabled=false).

Affected products

  • Apache Camel JMS >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0
  • Apache Camel SJMS >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0
  • Apache Camel SJMS2 >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0
  • Apache Camel AMQP >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0
  • Apache Camel ActiveMQ >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0
  • Apache Camel ActiveMQ6 >=3.0.0,<4.14.8; >=4.15.0,<4.18.3; >=4.19.0,<4.21.0

Identifiers

  • CVE-2026-43866
  • GHSA-f755-xp6r-8q84

Timeline

  • 2026-07-06: disclosed: Published to GitHub Advisory Database
  • 2026-07-06: patched: Patches released: camel-4.14.8, camel-4.18.3, camel-4.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.