CVE-2026-40473 - Vulnerability Analysis

Overview

Apache Camel 3.0.0 < 4.14.6, 4.15.0 < 4.18.2, 4.19.0 < 4.20.0 contains a remote code execution caused by lack of ObjectInputFilter in camel-mina's MinaConverter.toObjectInput, letting attackers sending crafted serialized Java objects execute arbitrary code remotely, exploit requires network access to MINA consumer port.

Severity & Score

Impact

Attackers can execute arbitrary code remotely by sending crafted serialized objects to the MINA consumer port, potentially compromising the application.

Mitigation

Upgrade to versions 4.14.6, 4.18.2, or 4.20.0 depending on your release stream.

References

• https://camel.apache.org/security/CVE-2026-40473.html
• http://www.openwall.com/lists/oss-security/2026/04/26/8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner