CVE Feed

    Dashboard / CVE / CVE-2026-40473

    CVE-2026-40473

    The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject(). This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

    Published:Apr 27, 2026
    Last Modified:Apr 28, 2026
    EPS:Apr 27, 2026
    EPSS Score:0.0008
    CVSS Score:8.8

    Affected Products

    Vendor
    Apache
    Product
    Camel

    Exploits

    https://github.com/oscerd/CVE-2026-40473

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2026-78329 (CVSS 9.8) — Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel…
    CVE-2026-71300 (CVSS 9.8) — Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects …
    CVE-2026-63621 (CVSS 5.3) — Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Componen…
    CVE-2026-66908 (CVSS 7.5) — Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apac…
    CVE-2026-66907 (CVSS 7.5) — Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache C…
    CVE-2026-66906 (CVSS 9.1) — Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apac…
    CVE-2026-60093 (CVSS 5.5) — Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects A…
    CVE-2026-59230 (CVSS 6.5) — Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 befor…
    CVE-2026-46588 (CVSS 7.3) — Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, fro…
    CVE-2026-46587 (CVSS 7.3) — Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, fro…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High