{"action":"Upgrade org.apache.camel:camel-sjms to 4.14.8 (4.14.x), 4.18.3 (4.18.x) or 4.21.0 (4.21.x) or later.","affected":[{"fixed":"4.14.8","introduced":"4.14.0"},{"fixed":"4.18.3","introduced":"4.18.0"},{"fixed":"4.21.0","introduced":"4.19.0"}],"component":"org.apache.camel:camel-sjms","cve_ids":["CVE-2026-42527"],"ecosystem":"Maven","epss":0.00668,"exploited":false,"fixed_versions":["4.14.8","4.18.3","4.21.0"],"ghsa_id":"GHSA-8h6p-jvhf-9hcr","id":"tcs_01M5N8MS2GNN0D4P9NK34GYEPD","modified_at":"2026-09-10T03:50:53.079533591Z","published_at":"2026-07-06T09:30:28Z","references":["https://osv.dev/vulnerability/GHSA-8h6p-jvhf-9hcr","https://nvd.nist.gov/vuln/detail/CVE-2026-42527","https://github.com/apache/camel/pull/22801","https://github.com/apache/camel/pull/22813","https://github.com/apache/camel/pull/22815","https://github.com/apache/camel/commit/1b60801edf9864465db7abf391539ee425a53e2c","https://github.com/apache/camel/commit/1ea8bf4b20898a570f0ac366c9be07ec300cce8d","https://github.com/apache/camel/commit/bc7f8cafd1d4752bf6b5a77c19fe9878258faffb","https://camel.apache.org/security/CVE-2026-42527.html","https://github.com/apache/camel","https://github.com/apache/camel/releases/tag/camel-4.14.7","https://github.com/apache/camel/releases/tag/camel-4.18.2","https://github.com/apache/camel/releases/tag/camel-4.21.0","https://issues.apache.org/jira/browse/CAMEL-23372","http://www.openwall.com/lists/oss-security/2026/07/05/4"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-8h6p-jvhf-9hcr#Maven/org.apache.camel:camel-sjms","url":"https://osv.dev/vulnerability/GHSA-8h6p-jvhf-9hcr"}],"summary":"Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure"}