CVE-2026-40048

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40048

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40048.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40048

Aliases

GHSA-v3vg-332r-mw99

Published

2026-04-27T07:53:54.636Z

Modified

2026-07-08T08:13:12.568111791Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

Details

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of <keyId>.key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject() has already returned, so any readObject() side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.

This issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.

Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.19.0"
                },
                {
                    "fixed": "4.20.0"
                },
                {
                    "introduced": "4.18.0"
                },
                {
                    "fixed": "4.18.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "4.19.0"
                },
                {
                    "fixed": "4.20.0"
                },
                {
                    "introduced": "4.18.0"
                },
                {
                    "fixed": "4.18.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40048.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type

GIT

Repo

https://github.com/apache/camel

Events

Introduced

dd22f752e240bd1343af15c775ef02d754f6df38

Fixed

2326a42c5595aa1eee21caafeee75f8e7f0261ea

Introduced

3e9f3011ad48de66fef582ade9794c7340c23af7

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.18.0"
        },
        {
            "fixed": "4.18.2"
        },
        {
            "introduced": "4.19.0"
        },
        {
            "last_affected": "4.19.0"
        }
    ]
}

Affected versions

4.*

4.19.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40048.json"