Detections
Analytics

SCA: security update for org.apache.camel:camel-activemq, org.apache.camel:camel-activemq6, org.apache.camel:camel-amqp, org.apache.camel:camel-jms, org.apache.camel:camel-sjms, org.apache.camel:camel-sjms2 (GHSA-m5vh-3fw5-5wgh)

high Tenable Cloud Security Plugin ID 446358

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms,
 deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject()
 without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is
 reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an
 attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could
 achieve remote code execution when a deserialization gadget chain was present on the classpath. The same
 handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and
 through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on
 JmsComponent such as camel-activemq and camel-activemq6. This issue affects Apache Camel: from 3.0.0
 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to
 version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are
 suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to
 upgrade to 4.18.2. (CVE-2026-40860)

Solution

Update the org.apache.camel:camel-activemq library and its related packages to version 4.14.7 or later.

See Also

https://github.com/advisories/GHSA-m5vh-3fw5-5wgh

Plugin Details

Severity: High

ID: 446358

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/26/2026

Updated: 8/26/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.89

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-40860

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/27/2026

Vulnerability Publication Date: 4/27/2026

Reference Information

CVE: CVE-2026-40860

cwe: CWE-502