Deserialization of Untrusted Data in Apache Camel

Executive Summary

CVE-2026-42527 is a medium-severity vulnerability in Apache Camel involving deserialization of untrusted data.

The default ObjectInputFilter pattern used by several Apache Camel components allows certain Java classes like java.net.URL and java.net.InetAddress, which can perform network input/output operations during deserialization.

When an attacker sends a specially crafted Java-serialized payload to an affected Camel consumer, deserialization of collections containing java.net.URL keys causes the Java Virtual Machine to issue DNS queries to attacker-controlled hosts as a side effect.

This happens because the filter allows the HashMap class (or similar collections) which calls hashCode on its elements, triggering network activity during deserialization.

The vulnerability is especially significant in the camel-jms family of components due to default settings that automatically deserialize ObjectMessages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure through an out-of-band side channel.

Specifically, an attacker can observe DNS queries triggered by the deserialization process on a DNS server they control, potentially leaking sensitive information about the internal system or environment.

The impact is highest in environments using the camel-jms components with default configurations, where untrusted serialized data can be deserialized automatically.

Attackers could exploit this to gain insights into internal network details or to confirm the presence of vulnerable systems.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual DNS queries originating from the JVM during deserialization processes, especially DNS queries to attacker-controlled hosts triggered by deserialization of Java-serialized payloads containing java.net.URL keys.

Network monitoring tools or DNS logs can be used to detect these suspicious DNS queries as an indicator of exploitation attempts.

Specific commands are not provided in the available resources, but general approaches include capturing DNS traffic with tools like tcpdump or Wireshark, for example:

• tcpdump -i <interface> port 53
• or using system logs to detect JVM deserialization activity if logging is enabled.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Apache Camel to a fixed version: 4.14.8 for the 4.14.x line, 4.18.3 for the 4.18.x line, or 4.21.0 for the 4.21.x line.

For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list to restrict deserialization, such as:

• Apache ActiveMQ Artemis 'deserializationAllowList' or 'deserializationDenyList'
• Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES'

Additionally, override the default deserialization filter by setting the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny pattern like '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for aggregation-repository components).

Useful 0 Not Useful 0