CVE-2026-42527: Apache Camel Deserialization DNS Reconnaissance Vulnerability

Technical summary

CVE-2026-42527 is a CWE-502 deserialization vulnerability affecting Apache Camel versions 4.14.0–4.14.7, 4.15.0–4.18.2, and 4.19.0–4.20.x. The ObjectInputFilter patterns used for defense-in-depth employ a recursive 'java.**' glob that inadvertently permits classes whose hashCode, equals, or readObject methods perform network operations—primarily java.net.URL and java.net.InetAddress. When a HashMap containing these classes as keys is deserialized, those methods are invoked during the deserialization process itself, before any class-level allow-list check occurs. In the JmsBinding component, the default mapJmsMessage=true setting causes ObjectMessage.getObject() to deserialize unconditionally, creating a direct attack surface. The vulnerability affects camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation-repository components (camel-leveldb, camel-cassandraql, camel-consul, camel-sql).

Business impact

This vulnerability enables attackers to discover network topology and verify the presence of specific systems without triggering traditional intrusion detection. In regulated environments, unauthorized DNS queries may violate data residency or network segmentation policies. The out-of-band channel can be weaponized for reconnaissance prior to a targeted attack. For organizations running Camel-based message brokers in zero-trust or air-gapped networks, the ability to perform external DNS lookups represents a control bypass. Reputational risk exists if an organization's infrastructure is observed querying attacker-controlled domains during forensic analysis.

Affected systems

Apache Camel deployments in versions 4.14.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are vulnerable. The most critical scenario involves camel-jms and camel-sjms consumers with default JMS configuration; camel-amqp, camel-mina, camel-netty, and camel-netty-http also accept serialized payloads. Aggregation-repository components (camel-leveldb, camel-cassandraql, camel-consul, camel-sql) are affected if they process untrusted serialized state. Any deployment accepting serialized Java objects from external message brokers, files, or network endpoints is at risk.

Exploitability

Exploitability is moderate-to-high. The attack requires the ability to deliver a serialized Java object to an affected Camel consumer—typically through a JMS broker, but also through other transport protocols that Camel supports. No authentication or special privileges are required if the consumer is exposed to untrusted message sources. The attacker's DNS server must be reachable from the target network, and the exploitation is passive from the JVM's perspective; the DNS query occurs as a side effect of deserialization. Detection via network monitoring is straightforward if an organization logs DNS queries. Weaponization does not require custom gadget chains or complex serialization payloads; a standard HashMap with URL keys suffices.

Remediation

Upgrade to Apache Camel 4.21.0 (for 4.21.x), 4.18.3 (for 4.18.x), or 4.14.8 (for 4.14.x) to obtain the CAMEL-23372 fix. If immediate upgrade is not feasible, implement compensating controls: configure allow-list and deny-list policies on the JMS broker itself (ActiveMQ Artemis 'deserializationAllowList'/'deserializationDenyList' or ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES'), and/or override Camel's endpoint-level 'deserializationFilter' option or JVM-wide '-Djdk.serialFilter' property to explicitly deny java.net.** classes before permitting others.

Patch guidance

Verify availability and test the target patch version in a non-production environment before rollout. For the 4.14.x line, patch to 4.14.8 or later; for 4.18.x, patch to 4.18.3 or later; for 4.21.x, patch to 4.21.0 or later. Check the Apache Camel release notes and security advisory for any additional considerations or breaking changes. Rolling deployment is recommended for high-availability installations. After patching, confirm that the ObjectInputFilter pattern no longer uses the vulnerable recursive 'java.**' glob and explicitly denies 'java.net.**'.

Detection guidance

Monitor outbound DNS queries from systems running Camel consumers, particularly unexpected queries to external or attacker-controlled domains. Enable JVM serialization logging via '-Djdk.serialFilter=java.util.logging.ConsoleHandler' to log deserialization attempts. Review message broker logs for unusual or unexpected serialized payloads. Implement network segmentation to restrict DNS egress from message processing tiers. Search deployment configurations for instances of JmsBinding with mapJmsMessage=true and non-restrictive ObjectInputFilter patterns. Correlate suspicious DNS activity with Camel application restarts or message ingestion events.

Why prioritize this

Assign HIGH priority. The vulnerability affects widely-deployed message-processing infrastructure, requires only network-adjacent access to deliver payloads, and enables reconnaissance that can precede more damaging attacks. The CVSS score of 8.1 reflects high confidentiality and integrity impact despite moderate attack complexity. Although patches are available for all affected versions, the prevalence of Camel in enterprise integration platforms and the ease of exploitation warrant rapid remediation. Organizations with Camel deployments exposed to untrusted message sources should prioritize patching or deploying compensating controls within 7–14 days.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) is driven by: Network attack vector (AV:N), no user interaction required (UI:N), and high impact on confidentiality and integrity (C:H, I:H, A:H). Attack complexity is High (AC:H) because the attacker must craft a specific serialized payload and have a network path to the target. The scope is Unchanged (S:U). The score appropriately captures the severity of an information-disclosure channel that can be leveraged for lateral movement reconnaissance, balanced against the requirement to deliver a crafted payload.

Frequently asked questions