{"id":"CVE-2026-40048","aliases":["EUVD-2026-25790","GHSA-v3vg-332r-mw99"],"status":"published","title":"Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00327,"percentile":0.26018,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2026-04-27T07:53:54Z","modified":"2026-11-04T03:45:10Z","exploits":[{"source":"pocgithub","id":"oscerd/CVE-2026-40048","title":"oscerd/CVE-2026-40048","date":"2026-07-08","url":"https://github.com/oscerd/CVE-2026-40048"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.camel:camel-pqc","fixed_in":["4.18.2","4.20.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-pqc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-pqc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.19.0"},{"last_affected":"4.19.0"},{"fixed":"4.20.0"}]}],"versions":["4.19.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-pqc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2"}]}],"versions":["4.12.0","4.13.0","4.14.0","4.14.1","4.14.2","4.14.3","4.14.4","4.14.5","4.14.6","4.14.7","4.14.8","4.14.9","4.15.0","4.16.0","4.17.0","4.18.0","4.18.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-pqc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.19.0"},{"fixed":"4.20.0"}]}],"versions":["4.19.0"]}],"products":[{"vendor":"apache","product":"camel"},{"vendor":"apache software foundation","product":"apache camel pqc"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"}],"references":[{"url":"https://camel.apache.org/security/CVE-2026-40048.html","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/26/6","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40048","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463176","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40048.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40048","tags":["advisory"]},{"url":"https://github.com/apache/camel/pull/22034","tags":["web"]},{"url":"https://github.com/apache/camel/pull/22495","tags":["web"]},{"url":"https://github.com/apache/camel/commit/5bdd0f1d3289dfa78116deec6c81083708bf432d","tags":["web"]},{"url":"https://github.com/apache/camel/commit/5f87a86f4e337efc59248d278c6a5650e73b3b7c","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/CAMEL-23200","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v3vg-332r-mw99"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40048.json","tags":["advisory"]},{"url":"https://github.com/apache/camel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40048","title":"Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","status":"published","published":"2026-04-27T07:53:54.636Z","modified":"2026-07-15T01:01:31.729Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502","CWE-502"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-25790","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","status":"published","published":"2026-04-27T07:53:54Z","modified":"2026-07-15T01:01:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-v3vg-332r-mw99","title":"Camel-PQC Vulnerable to Deserialization of Untrusted Data","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","status":"published","published":"2026-04-27T09:34:38Z","modified":"2026-11-04T03:26:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-04T03:52:50.391589Z"}],"nvd":[{"id":"CVE-2026-40048","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","status":"published","published":"2026-04-27T09:16:01.287Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-40048","title":"Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","status":"published","published":"2026-04-27T07:53:54.636Z","modified":"2026-10-28T02:30:30.306641688Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"GHSA-v3vg-332r-mw99","title":"Camel-PQC Vulnerable to Deserialization of Untrusted Data","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","status":"published","published":"2026-04-27T09:34:38Z","modified":"2026-11-04T03:45:10.341399791Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-04T03:56:18.279609Z"}]}}