CVE-2026-42527

{"id": "CVE-2026-42527", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42527", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T18:47:03.658679Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Camel", "versions": [{"status": "affected", "version": "4.14.0", "lessThan": "4.14.8", "versionType": "semver"}, {"status": "affected", "version": "4.15.0", "lessThan": "4.18.3", "versionType": "semver"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.21.0", "versionType": "semver"}], "packageName": "org.apache.camel:camel", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:35.657", "references": [{"url": "https://camel.apache.org/security/CVE-2026-42527.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/05/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Apache Camel.\n\nThe default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. The class-level filter check passes because the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository).\nThis issue affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not include javax.**)."}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables en Apache Camel.\n\nEl patr\u00f3n ObjectInputFilter predeterminado que se env\u00eda con varios componentes de Apache Camel para el filtrado de deserializaci\u00f3n de defensa en profundidad (\u2019java.;javax.;org.apache.camel.**;!*\u2019, o la variante sin \u2019javax.\u2019 en los componentes de repositorio de agregaci\u00f3n) utiliza un glob recursivo \u2019java.\u2019 que admite clases cuyos m\u00e9todos hashCode/equals/readObject realizan E/S de red, notablemente java.net.URL y java.net.InetAddress. Cuando un atacante puede entregar una carga \u00fatil serializada en Java a un consumidor de Camel afectado, la deserializaci\u00f3n de un HashMap (o cualquier colecci\u00f3n que llame a hashCode en sus elementos) que contiene claves java.net.URL hace que la JVM emita consultas DNS al host proporcionado por el atacante durante el efecto secundario de la deserializaci\u00f3n. La verificaci\u00f3n del filtro a nivel de clase pasa porque la clase del objeto resultante (HashMap) est\u00e1 en la lista de permitidos; la consulta DNS es observable en un servidor DNS controlado por el atacante, proporcionando un canal lateral fuera de banda. La exposici\u00f3n es mayor en la familia camel-jms porque JmsBinding.extractBodyFromJms invoca ObjectMessage.getObject() incondicionalmente cuando mapJmsMessage=true (predeterminado). Componentes afectados: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-HTTP, camel-vertx-HTTP, camel-infinispan, y los componentes de repositorio de agregaci\u00f3n camel-leveldb, camel-cassandraql, camel-consul, camel-sql (repositorio de agregaci\u00f3n JDBC).\nEste problema afecta a Apache Camel: desde 4.14.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a una versi\u00f3n que contenga la correcci\u00f3n CAMEL-23372 una vez disponible: 4.21.0 para la l\u00ednea 4.21.x, 4.18.3 para la l\u00ednea 4.18.x y 4.14.8 para la l\u00ednea 4.14.x. Para implementaciones que no pueden actualizarse inmediatamente, configure una lista de permitidos del lado del proveedor de JMS (Apache ActiveMQ Artemis \u2019deserializationAllowList\u2019 / \u2019deserializationDenyList\u2019, Apache ActiveMQ Classic \u2019org.apache.activemq.SERIALIZABLE_PACKAGES\u2019) como la mitigaci\u00f3n principal, y/o anule el valor predeterminado en el c\u00f3digo a trav\u00e9s de la opci\u00f3n \u2019deserializationFilter\u2019 a nivel de endpoint o la propiedad del sistema \u2019-Djdk.serialFilter\u2019 a nivel de JVM con una denegaci\u00f3n expl\u00edcita: \u2019!java.net.;java.;javax.;org.apache.camel.;!*\u2019 (o \u2019!java.net.;java.;org.apache.camel.**;!*\u2019 para los componentes de repositorio de agregaci\u00f3n, que no incluyen javax.**)."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58BD2573-EEBB-4D76-B3B7-038A53515204", "versionEndExcluding": "4.14.8", "versionStartIncluding": "4.14.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F672322-AA52-4621-B687-76B5AC9D619F", "versionEndExcluding": "4.18.3", "versionStartIncluding": "4.18.0"}, {"criteria": "cpe:2.3:a:apache:camel:4.20.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "526A7504-CAAA-43DD-97B2-8A18093E97C9"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}