Deserialization fix bypass via DefaultExchangeHolder in Apache Camel JMS (CVE-2026-40860)

The post-deserialization class allowlist introduced to fix CVE-2026-40860 in Apache Camel's JMS components can be bypassed by wrapping a crafted payload inside a `DefaultExchangeHolder` object, which resides in the allow-listed `org.apache.camel.**` namespace and therefore passes the check. Because the receiving side calls `DefaultExchangeHolder.unmarshal()` without requiring the `transferExchange` option to be enabled, an attacker able to publish an `ObjectMessage` to a queue or topic consumed by an affected Camel application can inject arbitrary Exchange state-including the message body, headers, exchange properties, and exception field-using only universally-trusted `java.lang` and `java.util` types, with no deserialization gadget chain required. This affects `camel-jms`, `camel-sjms`, `camel-sjms2`, `camel-amqp`, `camel-activemq`, and `camel-activemq6`. Affected versions: - Apache Camel (org.apache.camel:camel-jms) 3.0.0 before 4.14.8 - Apache Camel (org.apache.camel:camel-jms) 4.15.0 before 4.18.3 - Apache Camel (org.apache.camel:camel-jms) 4.19.0 before 4.21.0 - Apache Camel (org.apache.camel:camel-sjms) 3.0.0 before 4.14.8 - Apache Camel (org.apache.camel:camel-sjms) 4.15.0 before 4.18.3 - Apache Camel (org.apache.camel:camel-sjms) 4.19.0 before 4.21.0 We recommend updating to: 4.21.0. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/70 Details: https://vuln.today/cve/CVE-2026-40860