Arbitrary Code Execution in Apache Camel's MinaConverter Component

CVE-2026-40473

What is CVE-2026-40473?

The Apache Camel MinaConverter component is prone to a vulnerability that permits an attacker to exploit the serialization process by sending a crafted serialized Java object over the network. This issue occurs due to the lack of ObjectInputFilter or class-loading restrictions when the MinaConverter wraps an IoBuffer in an ObjectInputStream. As a result, an attacker could trigger arbitrary code execution within the application context during the deserialization process. Addressing this vulnerability requires users to upgrade to the latest versions of Apache Camel, specifically 4.20.0 or 4.14.6 for LTS releases.

References