Apache Camel PQC Component Vulnerability: Critical CVE Alert
- Severity
- HIGH
- Affected component
- apache camel:camel-pqc (maven)
- Affected versions
- >= 4.19.0, <= 4.19.0 or >= camel-4.19.0, <= camel-4.19.0
- Patched version
- 4.21.0
An early warning has been issued for a critical deserialization vulnerability in the Apache Camel PQC Component. Users of affected versions are advised to upgrade immediately.
What happened
An early warning has been issued for a critical deserialization vulnerability in the Apache Camel PQC Component. This vulnerability, tracked as CVE-2026-40048 and CVE-2026-46590, allows for potential code execution due to the deserialization of untrusted data. The affected versions are those before 4.18.3 and before 4.19.0, 4.21.0. The vulnerability arises from the AWS Secrets Manager key-lifecycle manager deserializing persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter, as reported in the GitHub Advisory Database under GHSA-7CMX-QJH8-7V3V.
This vulnerability has not been exploited in the wild as of the latest reports. However, the severity is high, and immediate action is recommended to mitigate potential risks. The Apache Camel team has released version 4.21.0 to address this issue, along with version 4.18.3 for LTS releases.
What to do about it
- Upgrade to Apache Camel version 4.21.0 or 4.18.3 for LTS releases to mitigate the vulnerability.
- Review your application's use of the Apache Camel PQC Component to ensure it is not exposed to untrusted data.
- Monitor the primary sources for updates on this vulnerability.
- Consider implementing additional security measures to protect against deserialization attacks in your application.
How 0Day would have caught this
apache camel:camel-pqc is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Apache Camel PQC Component versions before 4.18.3 and before 4.19.0, 4.21.0.
What should I do right now?
Upgrade to Apache Camel version 4.21.0 or 4.18.3 for LTS releases immediately.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild as of the latest reports.