CVE-2026-42527: Apache Camel Deserialization Vulnerability

CVE-2026-42527 Overview

CVE-2026-42527 is a deserialization of untrusted data vulnerability [CWE-502] affecting Apache Camel. The default ObjectInputFilter pattern shipped with several Camel components uses a recursive java.** glob that permits classes whose hashCode, equals, or readObject methods perform network I/O. Attackers can deliver a Java-serialized HashMap containing java.net.URL keys to an affected Camel consumer. Deserialization triggers a DNS query to the attacker-controlled host, creating an out-of-band side channel. The class-level filter check passes because the top-level object (HashMap) is allow-listed. The camel-jms family carries the highest exposure because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true.

Critical Impact
Remote attackers can trigger unauthenticated DNS exfiltration and network probing through Apache Camel consumers by delivering a crafted Java-serialized payload, bypassing the default deserialization allow-list.

Affected Products

Apache Camel 4.14.0 through 4.14.7
Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x (fixed in 4.21.0)

Discovery Timeline

2026-07-06 - CVE-2026-42527 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-42527

Vulnerability Analysis

The vulnerability originates in the default defense-in-depth serialization filter shipped with multiple Apache Camel components. The pattern java.**;javax.**;org.apache.camel.**;!* (or the no-javax.** variant used by aggregation-repository components) recursively allows every class under the java.* package tree. This includes java.net.URL and java.net.InetAddress, both of which execute network I/O during hashCode computation.

An attacker sends a serialized HashMap whose keys are java.net.URL instances pointing to an attacker-controlled host. When the receiving Camel component deserializes the payload, the JVM computes each key's hashCode, which resolves the URL host via DNS. The lookup lands on the attacker's authoritative DNS server, confirming reachability and disclosing information about the internal network.

Affected components include camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository modules camel-leveldb, camel-cassandraql, camel-consul, and camel-sql.

Root Cause

The filter enforces class-name checks at the top of the object graph but permits any class matching java.**. The ObjectInputFilter API validates the class being instantiated, not the side effects of its readObject, equals, or hashCode methods. java.net.URL.hashCode() invokes URLStreamHandler.hashCode(URL), which triggers getHostAddress() and issues a DNS query.

Attack Vector

Exploitation requires an attacker to reach a Camel consumer that reads Java-serialized data. On camel-jms routes with mapJmsMessage=true (the default), any producer permitted to publish an ObjectMessage to a monitored queue can trigger deserialization. The attack requires no authentication to Camel itself and no user interaction. See the Apache Camel CVE-2026-42527 Advisory for the vendor description of the exploitation path.

// No verified public proof-of-concept code is available.
// Conceptually: a serialized HashMap<java.net.URL, Object> is submitted to
// an affected Camel consumer; deserialization triggers URL.hashCode(),
// which performs a DNS resolution against the attacker-supplied host.

Detection Methods for CVE-2026-42527

Indicators of Compromise

Outbound DNS queries from Camel/JVM hosts to unexpected external domains, particularly with encoded subdomain labels typical of DNS exfiltration.
JMS ObjectMessage payloads received on queues consumed by Camel routes with mapJmsMessage=true.
Java stack traces referencing JmsBinding.extractBodyFromJms, ObjectInputStream.readObject, HashMap.readObject, and java.net.URL.hashCode on the same thread.
Unexplained java.net.InetAddress lookups originating during Camel consumer message processing.

Detection Strategies

Inspect broker traffic and application logs for ObjectMessage types on JMS destinations bound to Camel routes; legitimate traffic on modern deployments should rarely use Java serialization.
Enable JVM -Djdk.serialFilter logging or a custom ObjectInputFilter audit hook to record classes offered for deserialization on Camel consumer threads.
Correlate DNS resolver telemetry with Camel process IDs to surface deserialization-induced lookups against low-reputation domains.

Monitoring Recommendations

Forward JVM garbage collection, security, and application logs alongside DNS query telemetry into a centralized data lake for correlation across message brokers and Camel workers.
Alert on first-seen external domains resolved by Java processes hosting Camel routes.
Track version inventory for Apache Camel components and flag hosts still running vulnerable 4.14.x, 4.15.x–4.18.x, or 4.19.x–4.20.x builds.

How to Mitigate CVE-2026-42527

Immediate Actions Required

Upgrade Apache Camel to 4.14.8, 4.18.3, or 4.21.0, which contain the CAMEL-23372 fix.
On JMS deployments, configure a provider-side allow-list: Apache ActiveMQ Artemis deserializationAllowList and deserializationDenyList, or Apache ActiveMQ Classic org.apache.activemq.SERIALIZABLE_PACKAGES.
Where Java serialization is not required, set mapJmsMessage=false on camel-jms endpoints to prevent automatic ObjectMessage.getObject() invocation.
Audit all Camel routes consuming from network-reachable endpoints for unnecessary exposure and restrict producer identities.

Patch Information

Apache has released fixed versions 4.14.8, 4.18.3, and 4.21.0 through the CAMEL-23372 fix. Details are published in the Apache Camel CVE-2026-42527 Advisory and the OpenWall OSS Security List Post.

Workarounds

Override the default filter at the endpoint level using the deserializationFilter option with an explicit deny for java.net.**.
Set the JVM-wide -Djdk.serialFilter system property to !java.net.**;java.**;javax.**;org.apache.camel.**;!* for standard components.
For aggregation-repository components, use !java.net.**;java.**;org.apache.camel.**;!* since these do not include javax.**.
Restrict network egress from Camel worker hosts to prevent DNS traffic reaching arbitrary external resolvers.

bash

# JVM-wide filter override for Camel worker processes
JAVA_TOOL_OPTIONS="-Djdk.serialFilter='!java.net.**;java.**;javax.**;org.apache.camel.**;!*'"

# Endpoint-level filter (Camel URI option)
# from("jms:queue:inbound?deserializationFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*")

# ActiveMQ Classic broker-side allow-list
# -Dorg.apache.activemq.SERIALIZABLE_PACKAGES="org.apache.camel,java.lang,java.util"