The vulnerability in Apache Camel's camel-vertx-http component arises from unsafe deserialization of HTTP response bodies with the content type application/x-java-serialized-object. When transferException=true (or allowJavaSerializedObject=true) and throwExceptionOnFailure=true, the component uses a raw ObjectInputStream without applying any ObjectInputFilter, enabling deserialization of untrusted data. This can be exploited by an attacker controlling the backend service or positioned as a man-in-the-middle on unencrypted HTTP connections to send crafted serialized Java objects. If a suitable gadget chain exists on the classpath, this can lead to remote code execution on the host running the Camel application. The vulnerability affects Apache Camel versions 4.0.0 up to but not including 4.14.8, 4.15.0 up to but not including 4.18.3, and 4.19.0 up to but not including 4.20.0. The issue is fixed in versions 4.14.8, 4.18.3, and 4.20.0 respectively, where deserialization is constrained by a default ObjectInputFilter. Users are advised to upgrade or apply mitigations such as disabling transferException or using TLS and explicit deserialization filters.

An attacker who can control the backend HTTP service or intercept unencrypted HTTP traffic can exploit this vulnerability to send malicious serialized Java objects that may lead to remote code execution on the Apache Camel host, provided a suitable gadget chain is present. This can result in full compromise of the affected system. The vulnerability is conditional on specific configuration options (transferException=true or allowJavaSerializedObject=true) and is not exploitable in default configurations where transferException is false.

A fix is available in Apache Camel versions 4.14.8, 4.18.3, and 4.20.0. Users should upgrade to one of these versions depending on their release stream. After upgrading, deserialization is restricted by a default ObjectInputFilter, which can be customized. For users unable to upgrade immediately, do not enable transferException=true or allowJavaSerializedObject=true on producers communicating with untrusted or network-exposed backends. Ensure producer connections use TLS (HTTPS) to prevent man-in-the-middle attacks. Additionally, set an explicit JVM deserialization filter (-Djdk.serialFilter) to constrain deserialization to safe classes.