{"id":"CVE-2026-40048","aliases":["GHSA-v3vg-332r-mw99"],"title":"Camel-PQC Vulnerable to Deserialization of Untrusted Data","summary":"Camel-PQC Vulnerable to Deserialization of Untrusted Data","severity":"high","cvss":7.8,"cwe":["CWE-502"],"vendor":"apache","product":"org.apache.camel:camel-pqc","ecosystem":"maven","affected":["org.apache.camel:camel-pqc < 4.18.2","org.apache.camel:camel-pqc = 4.19.0"],"patched":["org.apache.camel:camel-pqc 4.18.2","org.apache.camel:camel-pqc 4.20.0"],"published":"2026-04-27","updated":"2026-11-04","sourceUpdated":"2026-11-04T03:26:50Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-v3vg-332r-mw99","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40048"},{"url":"https://camel.apache.org/security/CVE-2026-40048.html"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/26/6"},{"url":"https://github.com/apache/camel/pull/22034"},{"url":"https://github.com/apache/camel/pull/22495"},{"url":"https://github.com/apache/camel/commit/5bdd0f1d3289dfa78116deec6c81083708bf432d"},{"url":"https://github.com/apache/camel/commit/5f87a86f4e337efc59248d278c6a5650e73b3b7c"},{"url":"https://issues.apache.org/jira/browse/CAMEL-23200"},{"url":"https://access.redhat.com/security/cve/CVE-2026-40048"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463176"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40048.json"},{"url":"https://github.com/advisories/GHSA-v3vg-332r-mw99"}],"tags":["ghsa","maven","exploit-available"],"epss":0.00327,"epssPercentile":0.25904,"exploits":{"github":1,"githubRepos":["https://github.com/oscerd/CVE-2026-40048"],"checkedAt":"2026-11-05T15:40:42.826Z"},"exploitAvailable":true,"ingestedAt":"2026-11-04T04:03:28.567Z","slug":"CVE-2026-40048","body":"## Overview\n\nThe Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.\n\n## Affected packages\n\n- `org.apache.camel:camel-pqc < 4.18.2`\n- `org.apache.camel:camel-pqc = 4.19.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.apache.camel:camel-pqc 4.18.2`\n- `org.apache.camel:camel-pqc 4.20.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}