CVE-2026-40859 Overview
CVE-2026-40859 is a deserialization of untrusted data vulnerability [CWE-502] in the camel-vertx-http component of Apache Camel. The flaw allows an attacker who controls or intercepts backend HTTP responses to deliver crafted serialized Java objects that trigger remote code execution. The vulnerable code path in VertxHttpHelper.deserializeJavaObjectFromStream uses a raw java.io.ObjectInputStream with no ObjectInputFilter, permitting unrestricted class instantiation during deserialization.
Critical Impact
An attacker positioned between the Camel producer and its backend, or one who compromises the backend, can achieve remote code execution on the Camel application host when a suitable gadget chain is present on the classpath.
Affected Products
- Apache Camel 4.0.0 through 4.14.7
- Apache Camel 4.15.0 through 4.18.2
- Apache Camel 4.19.0
Discovery Timeline
- 2026-07-06 - CVE-2026-40859 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-40859
Vulnerability Analysis
The camel-vertx-http component deserializes HTTP response bodies that carry the application/x-java-serialized-object content type. Deserialization occurs through a raw java.io.ObjectInputStream without applying any ObjectInputFilter. The vulnerable path activates only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) while throwExceptionOnFailure remains at its default value of true.
Under these conditions, a backend HTTP response returning a 5xx status with the application/x-java-serialized-object content type has its body deserialized with no class restrictions. If a gadget chain such as those provided by common libraries is present on the classpath, deserialization can be chained into remote code execution on the Camel host.
Root Cause
The root cause is the absence of an allow-list ObjectInputFilter around ObjectInputStream.readObject() in VertxHttpHelper.deserializeJavaObjectFromStream. Java serialization inherently permits arbitrary class graph reconstruction, so any deserialization of attacker-controlled bytes without a filter exposes the JVM to gadget-chain exploitation.
Attack Vector
An attacker requires control of the HTTP response the Camel producer receives. This can be achieved by compromising the upstream service or by mounting a man-in-the-middle attack on an unencrypted plain HTTP connection. The attacker returns a 5xx response carrying application/x-java-serialized-object with a crafted serialized payload. The path is not reachable in the default configuration where transferException is false.
No verified public exploit code is available at this time. See the Apache Camel CVE-2026-40859 Advisory for technical details.
Detection Methods for CVE-2026-40859
Indicators of Compromise
- HTTP responses to Camel producers containing the Content-Type: application/x-java-serialized-object header, particularly with 5xx status codes.
- Unexpected outbound network connections, child process creation, or JVM class loading originating from the Camel application host following backend HTTP interactions.
- Presence of transferException=true or allowJavaSerializedObject=true in Camel route configurations targeting plain HTTP endpoints.
Detection Strategies
- Inspect Camel route definitions and application properties for vertx-http producer endpoints that enable Java serialized object transfer.
- Monitor JVM process behavior for anomalous subprocess execution or reflective class loading immediately after HTTP response processing.
- Enable and audit -Djdk.serialFilter logging at the JVM level to observe deserialization attempts of unexpected classes.
Monitoring Recommendations
- Log and alert on HTTP responses carrying application/x-java-serialized-object content type across enterprise egress and service-mesh telemetry.
- Track Apache Camel version inventory against the fixed versions 4.14.8, 4.18.3, and 4.20.0.
- Alert on plain HTTP (non-TLS) traffic between Camel producers and backend services in environments where serialized object transfer is enabled.
How to Mitigate CVE-2026-40859
Immediate Actions Required
- Upgrade Apache Camel to 4.20.0, or to 4.14.8 for the 4.14.x LTS stream, or to 4.18.3 for the 4.18.x stream.
- Audit all vertx-http producer configurations and disable transferException=true and allowJavaSerializedObject=true where not strictly required.
- Force TLS (https://) on all Camel producer endpoints to prevent man-in-the-middle substitution of responses.
Patch Information
Apache Camel versions 4.14.8, 4.18.3, and 4.20.0 fix the issue by applying a default ObjectInputFilter allow-list (java.**;javax.**;org.apache.camel.**;!*) to both helper utilities. The filter can be customized via the new deserializationFilter endpoint option or the JVM-wide -Djdk.serialFilter system property. Refer to the Apache Camel CVE-2026-40859 Advisory for full patch details.
Workarounds
- Leave transferException and allowJavaSerializedObject at their default values (false) on any producer that communicates with untrusted or network-reachable backends.
- Enforce TLS on all producer connections so response bodies cannot be substituted in transit.
- Where Java serialized object transfer is required, set an explicit JVM-wide serialization filter such as -Djdk.serialFilter=java.**;org.apache.camel.**;!* to constrain deserialization to a minimal allow-list.
# Configuration example
java -Djdk.serialFilter='java.**;org.apache.camel.**;!*' -jar camel-app.jar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
