CVE-2026-43866
6 advisories.
Maven/org.apache.camel:camel-jms CVE-2026-43866: high 7.3
Apache Camel JMS deserialization filter bypass
Action: Upgrade org.apache.camel:camel-jms to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.14.8 | - |
| 4.15.0 | 4.18.3 | - |
| 4.19.0 | 4.21.0 | - |
Fixed versions
| 4.14.8 | 4.18.3 | 4.21.0 |
Sources
- osv: GHSA-f755-xp6r-8q84
- https://nvd.nist.gov/vuln/detail/CVE-2026-43866
- https://github.com/apache/camel/pull/22970
- https://github.com/apache/camel/pull/22968
- https://github.com/apache/camel/pull/22945
- https://github.com/apache/camel/pull/22920
- https://github.com/apache/camel/pull/22918
- https://github.com/apache/camel/pull/22866
- https://github.com/apache/camel/commit/844bbf8c894c5e2bfa023579db80dcd3354c0e1b
- https://github.com/apache/camel/commit/81449eb6ef3edf856c84117ce708beb2ada8f650
- https://github.com/apache/camel/commit/75d7991b89265a2e8e62c7207165deb88c3a6ef3
- https://github.com/apache/camel/commit/6cb29c0bbd7d1c46f057eac46c4afa62c9f5e00f
- https://github.com/apache/camel/commit/17f8fcb22569f4c459b9e53c1485bfc764dc0015
- https://github.com/apache/camel/commit/01ead5e8473a2b2fca4902c0236978805b990c31
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23373
- https://issues.apache.org/jira/browse/CAMEL-23409
- https://camel.apache.org/security/CVE-2026-43866.html
CVE-2026-43866 · published · modified · JSON
Maven/org.apache.camel:camel-sjms CVE-2026-43866: high 7.3
Apache Camel JMS deserialization filter bypass
Action: Upgrade org.apache.camel:camel-sjms to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.14.8 | - |
| 4.15.0 | 4.18.3 | - |
| 4.19.0 | 4.21.0 | - |
Fixed versions
| 4.14.8 | 4.18.3 | 4.21.0 |
Sources
- osv: GHSA-f755-xp6r-8q84#Maven/org.apache.camel:camel-sjms
- https://nvd.nist.gov/vuln/detail/CVE-2026-43866
- https://github.com/apache/camel/pull/22970
- https://github.com/apache/camel/pull/22968
- https://github.com/apache/camel/pull/22945
- https://github.com/apache/camel/pull/22920
- https://github.com/apache/camel/pull/22918
- https://github.com/apache/camel/pull/22866
- https://github.com/apache/camel/commit/844bbf8c894c5e2bfa023579db80dcd3354c0e1b
- https://github.com/apache/camel/commit/81449eb6ef3edf856c84117ce708beb2ada8f650
- https://github.com/apache/camel/commit/75d7991b89265a2e8e62c7207165deb88c3a6ef3
- https://github.com/apache/camel/commit/6cb29c0bbd7d1c46f057eac46c4afa62c9f5e00f
- https://github.com/apache/camel/commit/17f8fcb22569f4c459b9e53c1485bfc764dc0015
- https://github.com/apache/camel/commit/01ead5e8473a2b2fca4902c0236978805b990c31
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23373
- https://issues.apache.org/jira/browse/CAMEL-23409
- https://camel.apache.org/security/CVE-2026-43866.html
CVE-2026-43866 · published · modified · JSON
Maven/org.apache.camel:camel-sjms2 CVE-2026-43866: high 7.3
Apache Camel JMS deserialization filter bypass
Action: Upgrade org.apache.camel:camel-sjms2 to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.14.8 | - |
| 4.15.0 | 4.18.3 | - |
| 4.19.0 | 4.21.0 | - |
Fixed versions
| 4.14.8 | 4.18.3 | 4.21.0 |
Sources
- osv: GHSA-f755-xp6r-8q84#Maven/org.apache.camel:camel-sjms2
- https://nvd.nist.gov/vuln/detail/CVE-2026-43866
- https://github.com/apache/camel/pull/22970
- https://github.com/apache/camel/pull/22968
- https://github.com/apache/camel/pull/22945
- https://github.com/apache/camel/pull/22920
- https://github.com/apache/camel/pull/22918
- https://github.com/apache/camel/pull/22866
- https://github.com/apache/camel/commit/844bbf8c894c5e2bfa023579db80dcd3354c0e1b
- https://github.com/apache/camel/commit/81449eb6ef3edf856c84117ce708beb2ada8f650
- https://github.com/apache/camel/commit/75d7991b89265a2e8e62c7207165deb88c3a6ef3
- https://github.com/apache/camel/commit/6cb29c0bbd7d1c46f057eac46c4afa62c9f5e00f
- https://github.com/apache/camel/commit/17f8fcb22569f4c459b9e53c1485bfc764dc0015
- https://github.com/apache/camel/commit/01ead5e8473a2b2fca4902c0236978805b990c31
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23373
- https://issues.apache.org/jira/browse/CAMEL-23409
- https://camel.apache.org/security/CVE-2026-43866.html
CVE-2026-43866 · published · modified · JSON
Maven/org.apache.camel:camel-amqp CVE-2026-43866: high 7.3
Apache Camel JMS deserialization filter bypass
Action: Upgrade org.apache.camel:camel-amqp to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.14.8 | - |
| 4.15.0 | 4.18.3 | - |
| 4.19.0 | 4.21.0 | - |
Fixed versions
| 4.14.8 | 4.18.3 | 4.21.0 |
Sources
- osv: GHSA-f755-xp6r-8q84#Maven/org.apache.camel:camel-amqp
- https://nvd.nist.gov/vuln/detail/CVE-2026-43866
- https://github.com/apache/camel/pull/22970
- https://github.com/apache/camel/pull/22968
- https://github.com/apache/camel/pull/22945
- https://github.com/apache/camel/pull/22920
- https://github.com/apache/camel/pull/22918
- https://github.com/apache/camel/pull/22866
- https://github.com/apache/camel/commit/844bbf8c894c5e2bfa023579db80dcd3354c0e1b
- https://github.com/apache/camel/commit/81449eb6ef3edf856c84117ce708beb2ada8f650
- https://github.com/apache/camel/commit/75d7991b89265a2e8e62c7207165deb88c3a6ef3
- https://github.com/apache/camel/commit/6cb29c0bbd7d1c46f057eac46c4afa62c9f5e00f
- https://github.com/apache/camel/commit/17f8fcb22569f4c459b9e53c1485bfc764dc0015
- https://github.com/apache/camel/commit/01ead5e8473a2b2fca4902c0236978805b990c31
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23373
- https://issues.apache.org/jira/browse/CAMEL-23409
- https://camel.apache.org/security/CVE-2026-43866.html
CVE-2026-43866 · published · modified · JSON
Maven/org.apache.camel:camel-activemq CVE-2026-43866: high 7.3
Apache Camel JMS deserialization filter bypass
Action: Upgrade org.apache.camel:camel-activemq to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.14.8 | - |
| 4.15.0 | 4.18.3 | - |
| 4.19.0 | 4.21.0 | - |
Fixed versions
| 4.14.8 | 4.18.3 | 4.21.0 |
Sources
- osv: GHSA-f755-xp6r-8q84#Maven/org.apache.camel:camel-activemq
- https://nvd.nist.gov/vuln/detail/CVE-2026-43866
- https://github.com/apache/camel/pull/22970
- https://github.com/apache/camel/pull/22968
- https://github.com/apache/camel/pull/22945
- https://github.com/apache/camel/pull/22920
- https://github.com/apache/camel/pull/22918
- https://github.com/apache/camel/pull/22866
- https://github.com/apache/camel/commit/844bbf8c894c5e2bfa023579db80dcd3354c0e1b
- https://github.com/apache/camel/commit/81449eb6ef3edf856c84117ce708beb2ada8f650
- https://github.com/apache/camel/commit/75d7991b89265a2e8e62c7207165deb88c3a6ef3
- https://github.com/apache/camel/commit/6cb29c0bbd7d1c46f057eac46c4afa62c9f5e00f
- https://github.com/apache/camel/commit/17f8fcb22569f4c459b9e53c1485bfc764dc0015
- https://github.com/apache/camel/commit/01ead5e8473a2b2fca4902c0236978805b990c31
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23373
- https://issues.apache.org/jira/browse/CAMEL-23409
- https://camel.apache.org/security/CVE-2026-43866.html
CVE-2026-43866 · published · modified · JSON
Maven/org.apache.camel:camel-activemq6 CVE-2026-43866: high 7.3
Apache Camel JMS deserialization filter bypass
Action: Upgrade org.apache.camel:camel-activemq6 to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.14.8 | - |
| 4.15.0 | 4.18.3 | - |
| 4.19.0 | 4.21.0 | - |
Fixed versions
| 4.14.8 | 4.18.3 | 4.21.0 |
Sources
- osv: GHSA-f755-xp6r-8q84#Maven/org.apache.camel:camel-activemq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-43866
- https://github.com/apache/camel/pull/22970
- https://github.com/apache/camel/pull/22968
- https://github.com/apache/camel/pull/22945
- https://github.com/apache/camel/pull/22920
- https://github.com/apache/camel/pull/22918
- https://github.com/apache/camel/pull/22866
- https://github.com/apache/camel/commit/844bbf8c894c5e2bfa023579db80dcd3354c0e1b
- https://github.com/apache/camel/commit/81449eb6ef3edf856c84117ce708beb2ada8f650
- https://github.com/apache/camel/commit/75d7991b89265a2e8e62c7207165deb88c3a6ef3
- https://github.com/apache/camel/commit/6cb29c0bbd7d1c46f057eac46c4afa62c9f5e00f
- https://github.com/apache/camel/commit/17f8fcb22569f4c459b9e53c1485bfc764dc0015
- https://github.com/apache/camel/commit/01ead5e8473a2b2fca4902c0236978805b990c31
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23373
- https://issues.apache.org/jira/browse/CAMEL-23409
- https://camel.apache.org/security/CVE-2026-43866.html
CVE-2026-43866 · published · modified · JSON