org.apache.camel:camel-sql@4.15.0

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing java.net.URL or java.net.InetAddress objects. When Camel accepts the object message and applies the permissive default filter, the deserialization side effects issue outbound network lookups to an attacker-controlled host, leaking information through the DNS query and allowing untrusted serialized data to influence the JVM’s network behavior.

Workarounds

• Configure a JMS-provider-side deserialization allow-list before accepting untrusted ObjectMessage payloads: use Apache ActiveMQ Artemis deserializationAllowList / deserializationDenyList, or Apache ActiveMQ Classic org.apache.activemq.SERIALIZABLE_PACKAGES, to block malicious Java-serialized objects from reaching Camel and triggering DNS lookup side effects during deserialization.
• If you cannot change the broker, override Camel’s default deserialization rules with an endpoint-level deserializationFilter or the JVM-wide -Djdk.serialFilter property, and include an explicit !java.net.** deny rule ahead of the broader java.** allow pattern to prevent java.net.URL / java.net.InetAddress from being deserialized.

Upgrade org.apache.camel:camel-sql to version 4.14.8, 4.18.3, 4.21.0 or higher.