Live › vulnerability › CVE-2026-40048
Apache Camel's camel-pqc module reads key files from its key directory with Java's ObjectInputStream without any filter, so a crafted serialized object runs code during key loading. An attacker who can write files into that key directory can execute code inside the Camel application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:31 UTC, 0h before NVD. All times on this page are UTC.
Only applications that use the camel-pqc component with file-based key storage are exposed, and only if an attacker can write to the key directory it reads from. Applications that use other key storage, or that lock down the key directory, are much less exposed. The sources do not describe a network-only trigger.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.camel:camel-pqc | maven | < 4.18.2 | 4.18.2 |
| org.apache.camel:camel-pqc | maven | = 4.19.0 | 4.20.0 |
| apache camel | vendor | >= 4.18.0, < 4.18.2 | 4.18.2 |
| apache camel | vendor | = 4.19.0 | – |
mvn dependency:tree | grep camel-pqc4.18.2 for the 4.18.x LTS stream (affected 4.18.0 before 4.18.2)4.20.0 for the 4.19.x line (affected 4.19.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of <keyId>.key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject() has already returned, so any readObject() side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.
Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-40048")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.