The Apache Camel camel-mina component is vulnerable to deserialization of untrusted data due to lack of ObjectInputFilter or class-loading restrictions when converting IoBuffer to ObjectInputStream. This allows an attacker to send crafted serialized Java objects over the network to trigger arbitrary code execution during deserialization. The vulnerability affects versions from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, and from 4.19.0 before 4.20.0. Fixed versions include 4.14.6, 4.18.2, and 4.20.0. The CVSS score is 8.8 (high severity).