Apache Camel CVE-2026-40859

Exploitation requires ALL of: the camel-vertx-http producer endpoint configured with transferException=true (or component-level allowJavaSerializedObject=true); throwExceptionOnFailure left at its default true; the backend returning an HTTP 5xx status with Content-Type application/x-java-serialized-object; a usable deserialization gadget chain present on the Camel application classpath; and an attacker position that can control the response - either a man-in-the-middle on an unencrypted (plain HTTP) producer connection or a compromised/attacker-controlled backend service. Limiting factors: the path is explicitly NOT reachable in the default configuration (transferException is false by default), so a deliberate non-default setting is mandatory; TLS on the producer connection defeats the MITM route; and absent a suitable gadget chain the deserialization does not yield code execution. Although the CVSS vector is PR:N (no authentication against the Camel app), the combined configuration, network-position, and classpath requirements are why complexity is rated AC:H.

The signals are mixed and should be read carefully. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 High) shows full confidentiality/integrity/availability impact and no authentication, but crucially AC:H reflects the significant preconditions: a non-default configuration plus either a man-in-the-middle position on plaintext HTTP or a compromised backend, plus a usable gadget chain. EPSS is low (0.39%, 31st percentile), and the vulnerability is NOT in CISA KEV, consistent with a targeted-rather-than-opportunistic profile. There is no SSVC record or POC in the provided data. The most important caveat is that PR:N can overstate accessibility: the description explicitly states the path 'is not reachable in the default configuration,' so real-world exposure depends on an operator having enabled transferException/allowJavaSerializedObject and on the presence of a gadget chain - verify these before treating this as internet-facing unauthenticated RCE. Net: a genuine high-severity RCE for the subset of deployments that opt into Java-serialized transfer over untrusted/plaintext channels, but low broad-exploitation likelihood otherwise.

An organization runs a Camel route whose vertx-http producer is configured with transferException=true and talks to an internal service over plain HTTP. An attacker on the network path (MITM) or who has compromised that backend returns a 5xx response with Content-Type application/x-java-serialized-object and a crafted gadget-chain payload; Camel deserializes it and executes attacker code on the Camel host. No public exploit is identified at time of analysis, and the AC:H rating reflects the MITM/backend-control and gadget-chain prerequisites.