---
title: "Security digest: April 27, 2026"
url: https://erroneo.us/security/2026-04-27/
description: "April 27, 2026 vulnerability digest: 7 critical advisories (Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-27
date_modified: 2026-04-27
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 27, 2026

7 critical advisories.

## Take stock

- Maven: 7 critical advisories ( org.apache.camel:camel-jms , org.apache.camel:camel-sjms , org.apache.camel:camel-sjms2 , org.apache.camel:camel-amqp , org.apache.camel:camel-activemq , org.apache.camel:camel-activemq6 , org.apache.camel:camel-coap , org.apache.camel:camel-google-pubsub …). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-40860](https://erroneo.us/security/cve/CVE-2026-40860/index.md) Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage — Maven org.apache.camel:camel-jms >= 3.0.0, < 4.14.7 → 4.14.7; Maven org.apache.camel:camel-jms >= 4.15.0, < 4.18.2 → 4.18.2; Maven org.apache.camel:camel-jms >= 4.19.0, < 4.20.0 → 4.20.0
- [CVE-2026-40453](https://erroneo.us/security/cve/CVE-2026-40453/index.md) Apache Camel has an incomplete fix for CVE-2025-27636 — Maven org.apache.camel:camel-coap >= 3.0.0, < 4.14.6 → 4.14.6; Maven org.apache.camel:camel-coap >= 4.15.0, < 4.18.2 → 4.18.2; Maven org.apache.camel:camel-coap >= 4.19.0, < 4.20.0 → 4.20.0
- [CVE-2026-41409](https://erroneo.us/security/cve/CVE-2026-41409/index.md) Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix) — Maven org.apache.mina:mina-core >= 2.0.0, < 2.0.28 → 2.0.28; Maven org.apache.mina:mina-core >= 2.1.0, < 2.1.11 → 2.1.11; Maven org.apache.mina:mina-core >= 2.2.0, < 2.2.6 → 2.2.6
- [CVE-2026-40976](https://erroneo.us/security/cve/CVE-2026-40976/index.md) Spring Boot's default security filter chain has no authorization rule with Actuator but without Health — Maven org.springframework.boot:spring-boot >= 4.0.0, < 4.0.6 → 4.0.6
- [CVE-2026-41635](https://erroneo.us/security/cve/CVE-2026-41635/index.md) Apache MINA vulnerable to Deserialization of Untrusted Data — Maven org.apache.mina:mina-core >= 2.0.0, < 2.0.28 → 2.0.28; Maven org.apache.mina:mina-core >= 2.1.0, < 2.1.11 → 2.1.11; Maven org.apache.mina:mina-core >= 2.2.0, < 2.2.6 → 2.2.6
- [CVE-2026-33453](https://erroneo.us/security/cve/CVE-2026-33453/index.md) Apache camel-coap allows header injection that can lead to remote code execution — Maven org.apache.camel:camel-coap >= 4.14.0, <= 4.14.5 → 4.14.6; Maven org.apache.camel:camel-coap >= 4.18.0, < 4.18.1 → 4.18.1
- [CVE-2026-33454](https://erroneo.us/security/cve/CVE-2026-33454/index.md) Apache Camel's Camel-Mail component is vulnerable to Camel message header injection — Maven org.apache.camel:camel-mail >= 3.0.0, < 4.14.6 → 4.14.6; Maven org.apache.camel:camel-mail >= 4.15.0, < 4.18.1 → 4.18.1

---
Source page: https://erroneo.us/security/2026-04-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt