CVE-2026-40858

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40858
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40858.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40858
Aliases
Published
2026-04-27T09:38:55.466Z
Modified
2026-07-16T03:30:51.986646716Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository
Details

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application.

This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23322 refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40858.json",
    "cwe_ids": [
        "CWE-502"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.14.7"
                },
                {
                    "introduced": "4.15.0"
                },
                {
                    "fixed": "4.18.2"
                },
                {
                    "introduced": "4.19.0"
                },
                {
                    "fixed": "4.20.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.14.7"
                },
                {
                    "introduced": "4.15.0"
                },
                {
                    "fixed": "4.18.2"
                },
                {
                    "introduced": "4.19.0"
                },
                {
                    "fixed": "4.20.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type
GIT
Repo
https://github.com/apache/camel
Events
Introduced
8d135894cd73970c82da5da0dc71ecc7f5521ad5
Fixed
d8b8b58531b4731bc1af9fdd7f73cff1817c7cee
Introduced
038f1b2acd0b2ee78e4bb84cd3139e64610bb259
Fixed
2326a42c5595aa1eee21caafeee75f8e7f0261ea
Introduced
3e9f3011ad48de66fef582ade9794c7340c23af7
Last affected
3e9f3011ad48de66fef582ade9794c7340c23af7
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.14.7"
        },
        {
            "introduced": "4.15.0"
        },
        {
            "fixed": "4.18.2"
        },
        {
            "introduced": "4.19.0"
        },
        {
            "last_affected": "4.19.0"
        }
    ]
}

Affected versions

4.*
4.19.0
camel-4.*
camel-4.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40858.json"