What is the CVSS score of CVE-2026-40473?

CVE-2026-40473 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apache Camel are affected by CVE-2026-40473?

Apache Camel's MINA component (versions 3.0.0 through 4.19.0) contains a code execution vulnerability triggered by specially crafted network messages.. A patch is available.

Is there a public PoC exploit available for CVE-2026-40473?

Yes, a public proof-of-concept exploit is available for CVE-2026-40473. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-40473?

Within 24 hours, identify all applications using Apache Camel camel-mina component and verify which are running affected versions (3.0.0 through 4.14.5, 4.15.0 through 4.18.1, or 4.19.0); immediately isolate or restrict network access to any affected endpoints. Within 7 days, apply the vendor-released patch by upgrading Apache Camel to the latest patched version per the official Apache advisory, prioritizing systems with direct network exposure. Within 30 days, complete regression testing of all patched applications to confirm MINA consumers operate correctly post-upgrade.

Apache Camel CVE-2026-40473

EUVD-2026-25792 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-27 security@apache.org

GHSA-vpr3-2659-rw55

Deserialization RCE Java Apache Camel

8.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Attacker needs no credentials (PR:N) - only network reach to the port - but exploitation depends on a non-default ObjectInput route config and a suitable gadget chain, so AC:H; full RCE gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:05 vuln.today

Patch released

Apr 28, 2026 - 19:43 nvd

Patch available

CVSS changed

Apr 27, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Apr 27, 2026 - 10:01 EUVD

EUVD ID Assigned

Apr 27, 2026 - 09:22 euvd

EUVD-2026-25792

CVE Published

Apr 27, 2026 - 09:16 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19 maven packages depend on org.apache.camel:camel-mina (3 direct, 16 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject().

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Articles & Coverage 1

POC Apache Camel 4.18.0: Three Critical RCE Vulnerabilities with Working PoC Exploits (CVE-2026-33453, CVE-2026-40473, CVE-2026-40858) Apr 27, 2026

AnalysisAI

Unsafe Java deserialization in the Apache Camel camel-mina component (versions 3.0.0 through 4.14.5, 4.15.0 through 4.18.1, and 4.19.0) allows remote attackers to achieve arbitrary code execution by delivering a crafted serialized object to a MINA TCP/UDP consumer that converts inbound data to ObjectInput. The flaw stems from MinaConverter.toObjectInput wrapping raw network bytes in an ObjectInputStream with no ObjectInputFilter or class allow-listing, so readObject() instantiates attacker-chosen classes. Publicly available exploit code exists and vendor patches are released, but there is no evidence of active exploitation (not in CISA KEV) and EPSS is very low at 0.08%.

Technical ContextAI

The affected technology is Apache Camel's camel-mina integration component, which uses Apache MINA as a network transport for TCP/UDP endpoints. Camel's type-converter mechanism includes MinaConverter.toObjectInput(IoBuffer), which converts an inbound MINA IoBuffer into a java.io.ObjectInput by wrapping it directly in a java.io.ObjectInputStream. This is a textbook CWE-502 (Deserialization of Untrusted Data) issue: no ObjectInputFilter (JEP 290), no class-loading restrictions, and no allow-list are applied, so any gadget class on the application classpath can be reached during readObject(). CPE data confirms the affected product as cpe:2.3:a:apache:camel across the listed version ranges (with 4.19.0 explicitly enumerated). Exploitation depends on gadget chains present in the deployed application's dependencies (e.g., Commons-Collections-style chains), which is why the practical impact scales with the target's classpath.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.20.0, which fixes the issue. For the 4.14.x LTS stream upgrade to 4.14.6, and for the 4.18.x stream upgrade to 4.18.2 (per https://camel.apache.org/security/CVE-2026-40473.html). If immediate patching is not possible, remove the exposure by not converting untrusted MINA input to ObjectInput - avoid getBody(ObjectInput.class)/@Body ObjectInput on camel-mina consumers and switch to a safe payload format (e.g., string, byte[], or a structured codec), which eliminates the readObject() path at the cost of changing how the route parses messages. As a network compensating control, restrict access to the MINA consumer port to trusted peers via firewall/segmentation so untrusted clients cannot reach the listener; the trade-off is that legitimate remote producers must be explicitly allow-listed. Where a JVM-wide serialization filter is feasible, set a restrictive ObjectInputFilter (JEP 290) allow-list, noting it may break other legitimate deserialization in the app. Consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-40473) for platform-specific fixed builds.