---
id: CVE-2026-40048
aliases:
  - GHSA-v3vg-332r-mw99
title: Camel-PQC Vulnerable to Deserialization of Untrusted Data
summary: Camel-PQC Vulnerable to Deserialization of Untrusted Data
severity: high
cvss: 7.8
cwe:
  - CWE-502
vendor: apache
product: 'org.apache.camel:camel-pqc'
ecosystem: maven
affected:
  - 'org.apache.camel:camel-pqc < 4.18.2'
  - 'org.apache.camel:camel-pqc = 4.19.0'
patched:
  - 'org.apache.camel:camel-pqc 4.18.2'
  - 'org.apache.camel:camel-pqc 4.20.0'
published: '2026-04-27'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T03:26:50Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-v3vg-332r-mw99'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40048'
  - url: 'https://camel.apache.org/security/CVE-2026-40048.html'
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/26/6'
  - url: 'https://github.com/apache/camel/pull/22034'
  - url: 'https://github.com/apache/camel/pull/22495'
  - url: >-
      https://github.com/apache/camel/commit/5bdd0f1d3289dfa78116deec6c81083708bf432d
  - url: >-
      https://github.com/apache/camel/commit/5f87a86f4e337efc59248d278c6a5650e73b3b7c
  - url: 'https://issues.apache.org/jira/browse/CAMEL-23200'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-40048'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2463176'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40048.json
  - url: 'https://github.com/advisories/GHSA-v3vg-332r-mw99'
tags:
  - ghsa
  - maven
  - exploit-available
epss: 0.00327
epssPercentile: 0.25904
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/oscerd/CVE-2026-40048'
  checkedAt: '2026-11-05T15:40:42.826Z'
exploitAvailable: true
ingestedAt: '2026-11-04T04:03:28.567Z'
---

## Overview

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.

This issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.

Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.

## Affected packages

- `org.apache.camel:camel-pqc < 4.18.2`
- `org.apache.camel:camel-pqc = 4.19.0`

## Remediation

Upgrade to a patched release:

- `org.apache.camel:camel-pqc 4.18.2`
- `org.apache.camel:camel-pqc 4.20.0`