Camel-PQC Vulnerable to Deserialization of Untrusted Data
The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of <keyId>.key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject() has already returned, so any readObject() side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.
Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.camel:camel-pqc | < 4.18.2 | 4.18.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-40048
- https://github.com/apache/camel/pull/22034
- https://github.com/apache/camel/pull/22495
- https://github.com/apache/camel/commit/5bdd0f1d3289dfa78116deec6c81083708bf432d
- https://github.com/apache/camel/commit/5f87a86f4e337efc59248d278c6a5650e73b3b7c
- https://camel.apache.org/security/CVE-2026-40048.html
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-23200
- http://www.openwall.com/lists/oss-security/2026/04/26/6
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-502- Platform
- Java / Kotlin (Maven)
- Package
org.apache.camel:camel-pqc- Disclosed
- 27.04.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v3vg-332r-mw99 - CC BY 4.0
Vulnerability history: org.apache.camel:camel-pqc
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 04.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
Disclosures per year
- 2026: 3
-
Camel-PQC Vulnerable to Deserialization of Untrusted Data this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.