## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-40859
# camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer (CVE-2026-40859)
This project demonstrates a **Java deserialization vulnerability** in Apache Camel's `camel-netty-http` and `camel-vertx-http` components, tracked as **CVE-2026-40859**. When a producer endpoint is configured with `transferException=true` (or the component-level `allowJavaSerializedObject=true`), a **backend HTTP response** with a failure status and `Content-Type: application/x-java-serialized-object` has its body deserialized with a raw `java.io.ObjectInputStream` and **no`ObjectInputFilter`**. An attacker who controls the backend the Camel producer talks to — a compromised service, or a man-in-the-middle on a plain-HTTP connection — can return a crafted serialized object and, if a gadget chain is on the classpath, achieve on the Camel host.