## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-42527
# Permissive Default ObjectInputFilter — DNS Side-Channel Reproducer (CVE-2026-42527)
This project demonstrates **CVE-2026-42527** in Apache Camel. The default `ObjectInputFilter` pattern that several Camel components ship for defense-in-depth deserialization filtering — `java.**;javax.**;org.apache.camel.**;!*` — uses a recursive `java.**` glob that **admits`java.net.URL`**. `java.net.URL.hashCode()` performs a DNS resolution of the URL's host, so deserializing a `HashMap` (or any collection that hashes its elements) containing a `java.net.URL` key causes the JVM to issue a **DNS query to an attacker-supplied host** during deserialization. The class-level filter check passes (the resulting object is a `HashMap`, which is allow-listed), so nothing stops it — an (not RCE).