CVE-2026-40860: Camel jms Unsafe Deserialization Of JMS ObjectMessage Vulnerability

CRITICAL
Advisory Identifier: GHSA-m5vh-3fw5-5wgh
Share
CVSS 9.8
CWE-502
Published
Advisory Summary

CVE-2026-40860 is a CRITICAL (CVSS 9.8) unsafe deserialization of jms objectmessage vulnerability (CWE-502: Deserialization of Untrusted Data) affecting Camel jms libraries in the Maven ecosystem. The issue involves unsafe deserialization of jms objectmessage. Remediation is available by upgrading affected packages to version 4.14.7, 4.18.2, 4.20.0.

CVE-2026-40860 at a Glance

CVE Identifier CVE-2026-40860
GHSA Identifier GHSA-m5vh-3fw5-5wgh
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-502: Deserialization of Untrusted Data
Affected Product Camel jms
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-40860

To remediate this vulnerability, upgrade all affected Camel jms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.camel:camel-jms fixed: 4.14.7 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jms</artifactId>
    <version>4.14.7</version>
</dependency>
org.apache.camel:camel-jms fixed: 4.18.2 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jms</artifactId>
    <version>4.18.2</version>
</dependency>
org.apache.camel:camel-jms fixed: 4.20.0 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jms</artifactId>
    <version>4.20.0</version>
</dependency>
org.apache.camel:camel-sjms fixed: 4.14.7 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-sjms</artifactId>
    <version>4.14.7</version>
</dependency>
org.apache.camel:camel-sjms fixed: 4.18.2 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-sjms</artifactId>
    <version>4.18.2</version>
</dependency>
org.apache.camel:camel-sjms fixed: 4.20.0 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-sjms</artifactId>
    <version>4.20.0</version>
</dependency>
org.apache.camel:camel-sjms2 fixed: 4.14.7 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-sjms2</artifactId>
    <version>4.14.7</version>
</dependency>
org.apache.camel:camel-sjms2 fixed: 4.18.2 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-sjms2</artifactId>
    <version>4.18.2</version>
</dependency>
org.apache.camel:camel-sjms2 fixed: 4.20.0 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-sjms2</artifactId>
    <version>4.20.0</version>
</dependency>
org.apache.camel:camel-amqp fixed: 4.14.7 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-amqp</artifactId>
    <version>4.14.7</version>
</dependency>
org.apache.camel:camel-amqp fixed: 4.18.2 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-amqp</artifactId>
    <version>4.18.2</version>
</dependency>
org.apache.camel:camel-amqp fixed: 4.20.0 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-amqp</artifactId>
    <version>4.20.0</version>
</dependency>
org.apache.camel:camel-activemq fixed: 4.14.7 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-activemq</artifactId>
    <version>4.14.7</version>
</dependency>
org.apache.camel:camel-activemq fixed: 4.18.2 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-activemq</artifactId>
    <version>4.18.2</version>
</dependency>
org.apache.camel:camel-activemq fixed: 4.20.0 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-activemq</artifactId>
    <version>4.20.0</version>
</dependency>
org.apache.camel:camel-activemq6 fixed: 4.14.7 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-activemq6</artifactId>
    <version>4.14.7</version>
</dependency>
org.apache.camel:camel-activemq6 fixed: 4.18.2 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-activemq6</artifactId>
    <version>4.18.2</version>
</dependency>
org.apache.camel:camel-activemq6 fixed: 4.20.0 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-activemq6</artifactId>
    <version>4.20.0</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.apache.camel

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-40860, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.camel

Analyze the terminal output to locate any version of Camel jms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.14.7), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.camel command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In Camel jms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6. This issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

CVE-2026-40860 Affected Camel jms Versions

18 component(s)
Fixed Versions:
4.14.74.18.24.20.0
Product / Package Ecosystem Affected Versions Fixed Version
org.apache.camel:camel-jms
maven/org.apache.camel/camel-jms
Maven
≥ 3.0.0
< 4.14.7
4.14.7
org.apache.camel:camel-jms
maven/org.apache.camel/camel-jms
Maven
≥ 4.15.0
< 4.18.2
4.18.2
org.apache.camel:camel-jms
maven/org.apache.camel/camel-jms
Maven
≥ 4.19.0
< 4.20.0
4.20.0
org.apache.camel:camel-sjms
maven/org.apache.camel/camel-sjms
Maven
≥ 3.0.0
< 4.14.7
4.14.7
org.apache.camel:camel-sjms
maven/org.apache.camel/camel-sjms
Maven
≥ 4.15.0
< 4.18.2
4.18.2
org.apache.camel:camel-sjms
maven/org.apache.camel/camel-sjms
Maven
≥ 4.19.0
< 4.20.0
4.20.0
org.apache.camel:camel-sjms2
maven/org.apache.camel/camel-sjms2
Maven
≥ 3.0.0
< 4.14.7
4.14.7
org.apache.camel:camel-sjms2
maven/org.apache.camel/camel-sjms2
Maven
≥ 4.15.0
< 4.18.2
4.18.2
org.apache.camel:camel-sjms2
maven/org.apache.camel/camel-sjms2
Maven
≥ 4.19.0
< 4.20.0
4.20.0
org.apache.camel:camel-amqp
maven/org.apache.camel/camel-amqp
Maven
≥ 3.0.0
< 4.14.7
4.14.7
org.apache.camel:camel-amqp
maven/org.apache.camel/camel-amqp
Maven
≥ 4.15.0
< 4.18.2
4.18.2
org.apache.camel:camel-amqp
maven/org.apache.camel/camel-amqp
Maven
≥ 4.19.0
< 4.20.0
4.20.0
org.apache.camel:camel-activemq
maven/org.apache.camel/camel-activemq
Maven
≥ 3.0.0
< 4.14.7
4.14.7
org.apache.camel:camel-activemq
maven/org.apache.camel/camel-activemq
Maven
≥ 4.15.0
< 4.18.2
4.18.2
org.apache.camel:camel-activemq
maven/org.apache.camel/camel-activemq
Maven
≥ 4.19.0
< 4.20.0
4.20.0
org.apache.camel:camel-activemq6
maven/org.apache.camel/camel-activemq6
Maven
≥ 3.0.0
< 4.14.7
4.14.7
org.apache.camel:camel-activemq6
maven/org.apache.camel/camel-activemq6
Maven
≥ 4.15.0
< 4.18.2
4.18.2
org.apache.camel:camel-activemq6
maven/org.apache.camel/camel-activemq6
Maven
≥ 4.19.0
< 4.20.0
4.20.0

References

NVD — CVE-2026-40860 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40860
Camel jms Source Repository REPOSITORY
https://github.com/apache/camel/pull/22598
Camel jms Source Repository REPOSITORY
https://github.com/apache/camel/pull/22603
Camel jms Source Repository REPOSITORY
https://github.com/apache/camel/pull/22604
Camel jms Source Repository REPOSITORY
https://github.com/apache/camel/pull/22639
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/0c06142c46a1422b6b49fab784a1087c50e48ee8
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/107e8c279cf9bf488843e33fb6333cc2d7f37c67
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/6a82709f0fc5431f46d2939547aacd2c7395c97a
Camel jms Security Information SECURITY
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40860.json
issues.apache.org/jira/browse/camel-2... WEB
https://issues.apache.org/jira/browse/CAMEL-23321
Camel jms Release RELEASE
https://github.com/apache/camel/releases/tag/camel-4.20.0
Camel jms Release RELEASE
https://github.com/apache/camel/releases/tag/camel-4.18.2
Camel jms Release RELEASE
https://github.com/apache/camel/releases/tag/camel-4.14.7
Camel jms Source Repository REPOSITORY
https://github.com/apache/camel
Camel jms Security Information SECURITY
https://camel.apache.org/security/CVE-2026-40860.html
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2463172
Camel jms Security Information SECURITY
https://access.redhat.com/security/cve/CVE-2026-40860
access.redhat.com/errata/rhsa-2026:22... WEB
https://access.redhat.com/errata/RHSA-2026:22453
access.redhat.com/errata/rhsa-2026:17... WEB
https://access.redhat.com/errata/RHSA-2026:17668
Camel jms Security Information SECURITY
http://www.openwall.com/lists/oss-security/2026/04/26/10

Frequently Asked Questions

What is CVE-2026-40860?
CVE-2026-40860 is a security vulnerability in Camel jms involving Unsafe Deserialization of JMS ObjectMessage under CWE-502: Deserialization of Untrusted Data.
Which Camel jms versions are affected?
Affected versions include releases prior to 4.14.7, 4.18.2, 4.20.0 across affected packages: org.apache.camel:camel-jms, org.apache.camel:camel-sjms, org.apache.camel:camel-sjms2, org.apache.camel:camel-amqp, org.apache.camel:camel-activemq, org.apache.camel:camel-activemq6.
What version fixes CVE-2026-40860?
Upgrading to 4.14.7, 4.18.2, 4.20.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is camel-jms affected?
Yes, org.apache.camel:camel-jms is affected in releases prior to 4.14.7, 4.18.2, 4.20.0. Upgrade your dependency to 4.14.7, 4.18.2, 4.20.0 or later.
Is camel-sjms affected?
Yes, org.apache.camel:camel-sjms is affected in releases prior to 4.14.7, 4.18.2, 4.20.0. Upgrade your dependency to 4.14.7, 4.18.2, 4.20.0 or later.
What is the CVSS score of CVE-2026-40860?
CVE-2026-40860 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-40860?
CVE-2026-40860 is classified under CWE-502: Deserialization of Untrusted Data (The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.).
How can I check Maven dependencies for CVE-2026-40860?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.camel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m5vh-3fw5-5wgh",
  "modified" : "2026-08-26T15:19:50Z",
  "published" : "2026-04-27T09:34:39Z",
  "aliases" : [ "CVE-2026-40860" ],
  "summary" : "Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage",
  "details" : "JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6.\n\nThis issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.14.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.15.0"
      }, {
        "fixed" : "4.18.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.19.0"
      }, {
        "fixed" : "4.20.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-sjms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.14.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-sjms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.15.0"
      }, {
        "fixed" : "4.18.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-sjms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.19.0"
      }, {
        "fixed" : "4.20.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-sjms2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.14.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-sjms2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.15.0"
      }, {
        "fixed" : "4.18.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-sjms2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.19.0"
      }, {
        "fixed" : "4.20.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-amqp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.14.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-amqp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.15.0"
      }, {
        "fixed" : "4.18.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-amqp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.19.0"
      }, {
        "fixed" : "4.20.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-activemq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.14.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-activemq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.15.0"
      }, {
        "fixed" : "4.18.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-activemq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.19.0"
      }, {
        "fixed" : "4.20.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-activemq6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.14.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-activemq6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.15.0"
      }, {
        "fixed" : "4.18.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-activemq6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.19.0"
      }, {
        "fixed" : "4.20.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40860"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/pull/22598"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/pull/22603"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/pull/22604"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/pull/22639"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/0c06142c46a1422b6b49fab784a1087c50e48ee8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/107e8c279cf9bf488843e33fb6333cc2d7f37c67"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/6a82709f0fc5431f46d2939547aacd2c7395c97a"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40860.json"
  }, {
    "type" : "WEB",
    "url" : "https://issues.apache.org/jira/browse/CAMEL-23321"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/releases/tag/camel-4.20.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/releases/tag/camel-4.18.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/releases/tag/camel-4.14.7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/camel"
  }, {
    "type" : "WEB",
    "url" : "https://camel.apache.org/security/CVE-2026-40860.html"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2463172"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-40860"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:22453"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:17668"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2026/04/26/10"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-502" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-26T15:19:50Z",
    "nvd_published_at" : "2026-04-27T09:16:01Z"
  }
}