CVE-2026-40859: Apache Camel Java Deserialization RCE Vulnerability – Urgent Patch Required

Technical summary

The vulnerability exists in VertxHttpHelper.deserializeJavaObjectFromStream, which processes HTTP response bodies with Content-Type application/x-java-serialized-object using raw java.io.ObjectInputStream without an ObjectInputFilter. The attack path activates only when both transferException=true (or component-level allowJavaSerializedObject=true) and the default throwExceptionOnFailure=true are set, allowing a 5xx response with serialized Java content to be deserialized unrestricted. Exploitation requires either a man-in-the-middle position on plain HTTP connections or direct compromise of the backend service. Success depends on the presence of exploitable gadget chains in the application classpath. The issue affects Apache Camel versions 4.0.0–4.14.7, 4.15.0–4.18.2, and 4.19.0–4.19.x.

Business impact

Organizations using Apache Camel with vertx-http producers connected to external or network-reachable backends face remote code execution risk if non-default exception transfer settings are enabled. Compromise could allow attackers to execute arbitrary commands, steal sensitive data, modify transactions, or pivot to other systems. Risk is elevated in environments with poor network segmentation or unencrypted backend communications. The opt-in nature of the vulnerable configuration may limit exposure, but misconfiguration or legacy deployments could be at risk. Incident response and forensics would be required following exploitation.

Affected systems

Apache Camel versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.19.x are affected. The vulnerability only activates in applications that explicitly configure transferException=true or allowJavaSerializedObject=true on vertx-http producer endpoints. Systems using default Camel configurations are not vulnerable. Any organization running Camel applications with custom exception-transfer logic connected to external or untrusted HTTP backends should inventory affected deployments immediately.

Exploitability

Exploitation is feasible but requires specific preconditions: either control of the backend service, a man-in-the-middle position on unencrypted HTTP, or a combination of both. The attack does not require user interaction or legitimate credentials. However, it does depend on suitable gadget chains being present in the application classpath; many standard Camel deployments will have such dependencies, but the exact exploitability varies by application configuration. The CVSS score of 8.1 (HIGH) reflects the high impact (remote code execution) balanced against the required non-default configuration and network position.

Remediation

Upgrade immediately to Apache Camel 4.20.0, 4.14.8, or 4.18.3 depending on your release stream. These versions introduce a default ObjectInputFilter restricting deserialization to safe package allowlists (java.**, javax.**, org.apache.camel.**) and reject all other classes. For organizations unable to patch immediately: disable transferException=true and allowJavaSerializedObject=true unless absolutely necessary; enforce TLS (HTTPS) for all backend connections to prevent man-in-the-middle substitution; and set an explicit JVM-wide -Djdk.serialFilter allowlist (e.g., java.**;org.apache.camel.**;!*) to constrain deserialization of any untrusted data.

Patch guidance

Verify your current Apache Camel version and release stream. If on 4.14.x (LTS), upgrade to 4.14.8 or later. If on 4.15.x–4.18.x, upgrade to 4.18.3 or later. If on 4.19.x or 4.20.0+, ensure you are on 4.20.0 or later. After patching, review your endpoint configurations to confirm transferException and allowJavaSerializedObject settings are set conservatively. Test the new deserializationFilter endpoint option if you require custom class allowlists. Consult the Apache Camel release notes and security advisory for version-specific migration details.

Detection guidance

Monitor application logs for ObjectInputStream deserialization errors or unexpected ClassNotFoundException messages related to serialized objects. Inspect vertx-http producer endpoint configurations for transferException=true or allowJavaSerializedObject=true settings; any such configurations should be reviewed and tested. Capture and inspect HTTP traffic between Camel applications and backends for responses with Content-Type application/x-java-serialized-object, especially on non-HTTPS connections. Implement network segmentation to restrict backend access and require mutual TLS. Review application dependencies for known gadget chains (e.g., commons-collections, spring-core) that could enable exploitation if deserialization occurs.

Why prioritize this

This vulnerability merits immediate attention despite its opt-in configuration requirement. Remote code execution on the Camel application host is a critical outcome, and the attack surface expands significantly in organizations with legacy configurations, misconfigured exception handling, or untrusted backend integrations. The CVSS 8.1 (HIGH) score and the existence of standard gadget chains in typical Java classpath dependencies make this a real and present threat. Patching is straightforward and low-risk, making rapid remediation highly advisable.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a HIGH severity vulnerability with a high impact (code execution, data breach, system compromise) and moderate attack complexity. The attack vector is network-based, but exploitation requires either control of a backend service or a privileged network position (man-in-the-middle on plain HTTP). The requirement for non-default configuration (transferException=true) and suitable gadget chains reduces the attack complexity but does not eliminate the risk, as both are common in real deployments. The scoring assumes an attacker with no privileges and no user interaction required.

Frequently asked questions