This is an automated email from the ASF dual-hosted git repository.

davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/main by this push:
     new acc4e469d515 CAMEL-24426: camel-gson, camel-jsonb - use the unmarshal 
type header only with allowUnmarshallType (#28156)
acc4e469d515 is described below

commit acc4e469d515f5d519b19e0190c102bcc6bd734b
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Oct 20 21:02:06 2026 +0200

    CAMEL-24426: camel-gson, camel-jsonb - use the unmarshal type header only 
with allowUnmarshallType (#28156)
    
    Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
 .../org/apache/camel/catalog/dataformats/gson.json |  5 +--
 .../apache/camel/catalog/dataformats/jackson.json  |  2 +-
 .../apache/camel/catalog/dataformats/jsonb.json    |  3 +-
 .../org/apache/camel/catalog/models/json.json      |  2 +-
 .../apache/camel/catalog/schemas/camel-spring.xsd  |  5 +--
 .../apache/camel/catalog/schemas/camel-xml-io.xsd  |  5 +--
 .../camel/catalog/schemas/camelYamlDsl-model.json  |  2 +-
 .../component/gson/GsonDataFormatConfigurer.java   |  7 ++++
 .../org/apache/camel/component/gson/gson.json      |  5 +--
 .../camel/component/gson/GsonDataFormat.java       | 21 ++++++++++--
 .../camel/component/gson/GsonDataFormatTest.java   | 11 +------
 .../gson/GsonUnmarshalTypeFromHeaderTest.java      | 17 +++++++++-
 .../gson/SpringGsonUnmarshalTypeFromHeaderTest.xml |  2 +-
 .../apache/camel/component/jackson/jackson.json    |  2 +-
 .../apache/camel/component/jackson3/jackson.json   |  2 +-
 .../component/jsonb/JsonbDataFormatConfigurer.java |  7 ++++
 .../org/apache/camel/component/jsonb/jsonb.json    |  3 +-
 .../camel/component/jsonb/JsonbDataFormat.java     | 27 ++++++++++++++--
 .../jsonb/JsonbUnmarshalTypeFromHeaderTest.java}   | 37 +++++++++++++++-------
 .../org/apache/camel/model/dataformat/json.json    |  2 +-
 .../camel/model/dataformat/JsonDataFormat.java     | 11 ++++---
 .../reifier/dataformat/JsonDataFormatReifier.java  |  3 ++
 .../modules/ROOT/attachments/security-model.yaml   |  3 ++
 .../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc    |  9 ++++++
 .../modules/ROOT/pages/security-model.adoc         |  5 +++
 .../dsl/yaml/deserializers/ModelDeserializers.java |  2 +-
 .../resources/schema/camelYamlDsl-canonical.json   |  2 +-
 .../resources/schema/camelYamlDsl-model.json       |  2 +-
 .../generated/resources/schema/camelYamlDsl.json   |  2 +-
 29 files changed, 154 insertions(+), 52 deletions(-)

diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/gson.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/gson.json
index bb860f0bafee..b1b147bfa11d 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/gson.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/gson.json
@@ -18,7 +18,8 @@
   "properties": {
     "prettyPrint": { "index": 0, "kind": "attribute", "displayName": "Pretty 
Print", "group": "common", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "To enable pretty printing output nicely 
formatted. Is by default false." },
     "unmarshalType": { "index": 1, "kind": "attribute", "displayName": 
"Unmarshal Type", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "Class name of the java type to use when 
unmarshalling." },
-    "contentTypeHeader": { "index": 2, "kind": "attribute", "displayName": 
"Content Type Header", "group": "common", "required": false, "type": "boolean", 
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "Whether the data format 
should set the Content-Type header with the type from the data format. For 
example application\/xml for data formats marshalling to XML, or 
application\/json for data formats marshalli [...]
-    "dateFormatPattern": { "index": 3, "kind": "attribute", "displayName": 
"Date Format Pattern", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "To configure the date format while marshall or 
unmarshall Date fields in JSON using Gson" }
+    "allowUnmarshallType": { "index": 2, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only be [...]
+    "contentTypeHeader": { "index": 3, "kind": "attribute", "displayName": 
"Content Type Header", "group": "common", "required": false, "type": "boolean", 
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "Whether the data format 
should set the Content-Type header with the type from the data format. For 
example application\/xml for data formats marshalling to XML, or 
application\/json for data formats marshalli [...]
+    "dateFormatPattern": { "index": 4, "kind": "attribute", "displayName": 
"Date Format Pattern", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "To configure the date format while marshall or 
unmarshall Date fields in JSON using Gson" }
   }
 }
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jackson.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jackson.json
index b5d55379b432..60f4d41e2401 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jackson.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jackson.json
@@ -32,7 +32,7 @@
     "moduleRefs": { "index": 13, "kind": "attribute", "displayName": "Module 
Refs", "group": "advanced", "label": "advanced", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use custom Jackson modules referred 
from the Camel registry. Multiple modules can be separated by comma." },
     "enableFeatures": { "index": 14, "kind": "attribute", "displayName": 
"Enable Features", "group": "advanced", "label": "advanced", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to enable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. Seri [...]
     "disableFeatures": { "index": 15, "kind": "attribute", "displayName": 
"Disable Features", "group": "advanced", "label": "advanced", "required": 
false, "type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to disable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. S [...]
-    "allowUnmarshallType": { "index": 16, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson is allowed to attempt to use the CamelJacksonUnmarshalType header 
during the unmarshalling. This should only be enabled when desired to be used." 
},
+    "allowUnmarshallType": { "index": 16, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only b [...]
     "timezone": { "index": 17, "kind": "attribute", "displayName": "Timezone", 
"group": "advanced", "label": "advanced", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "If set then Jackson will use the Timezone when 
marshalling\/unmarshalling." },
     "schemaResolver": { "index": 18, "kind": "attribute", "displayName": 
"Schema Resolver", "group": "advanced", "label": "advanced", "required": false, 
"type": "object", "javaType": 
"org.apache.camel.component.jackson.SchemaResolver", "deprecated": false, 
"autowired": false, "secret": false, "description": "Optional schema resolver 
used to lookup schemas for the data in transit." },
     "autoDiscoverSchemaResolver": { "index": 19, "kind": "attribute", 
"displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": 
"advanced", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": true, "description": "When not disabled, the SchemaResolver 
will be looked up into the registry." },
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jsonb.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jsonb.json
index 82e39121c12c..d89137d9303a 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jsonb.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/jsonb.json
@@ -18,6 +18,7 @@
   "properties": {
     "objectMapper": { "index": 0, "kind": "attribute", "displayName": "Jsonb 
instance", "group": "common", "required": false, "type": "string", "javaType": 
"java.lang.String", "deprecated": false, "autowired": false, "secret": false, 
"description": "Lookup and use the existing Jsonb instance with the given id." 
},
     "prettyPrint": { "index": 1, "kind": "attribute", "displayName": "Pretty 
Print", "group": "common", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "To enable pretty printing output nicely 
formatted. Is by default false." },
-    "unmarshalType": { "index": 2, "kind": "attribute", "displayName": 
"Unmarshal Type", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "Class name of the java type to use when 
unmarshalling." }
+    "unmarshalType": { "index": 2, "kind": "attribute", "displayName": 
"Unmarshal Type", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "Class name of the java type to use when 
unmarshalling." },
+    "allowUnmarshallType": { "index": 3, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only be [...]
   }
 }
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/json.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/json.json
index ebabe678aede..5a0e55ee5d3a 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/json.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/json.json
@@ -29,7 +29,7 @@
     "moduleRefs": { "index": 14, "kind": "attribute", "displayName": "Module 
Refs", "group": "advanced", "label": "advanced", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use custom Jackson modules referred 
from the Camel registry. Multiple modules can be separated by comma." },
     "enableFeatures": { "index": 15, "kind": "attribute", "displayName": 
"Enable Features", "group": "advanced", "label": "advanced", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to enable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. Seri [...]
     "disableFeatures": { "index": 16, "kind": "attribute", "displayName": 
"Disable Features", "group": "advanced", "label": "advanced", "required": 
false, "type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to disable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. S [...]
-    "allowUnmarshallType": { "index": 17, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson is allowed to attempt to use the CamelJacksonUnmarshalType header 
during the unmarshalling. This should only be enabled when desired to be used." 
},
+    "allowUnmarshallType": { "index": 17, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only b [...]
     "timezone": { "index": 18, "kind": "attribute", "displayName": "Timezone", 
"group": "advanced", "label": "advanced", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "If set then Jackson will use the Timezone when 
marshalling\/unmarshalling." },
     "schemaResolver": { "index": 19, "kind": "attribute", "displayName": 
"Schema Resolver", "group": "advanced", "label": "advanced", "required": false, 
"type": "object", "javaType": 
"org.apache.camel.component.jackson.SchemaResolver", "deprecated": false, 
"autowired": false, "secret": false, "description": "Optional schema resolver 
used to lookup schemas for the data in transit." },
     "autoDiscoverSchemaResolver": { "index": 20, "kind": "attribute", 
"displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": 
"advanced", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": true, "description": "When not disabled, the SchemaResolver 
will be looked up into the registry." },
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd
index 31bbebd95493..5913e89e8df4 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd
@@ -9344,8 +9344,9 @@ SerializationFeature.WRAP_ROOT_VALUE) to tell apart 
features with the same name.
           <xs:annotation>
             <xs:documentation xml:lang="en">
 <![CDATA[
-If enabled then Jackson is allowed to attempt to use the 
CamelJacksonUnmarshalType header during the unmarshalling. This
-should only be enabled when desired to be used. Default value: false
+If enabled then Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType,
+CamelGsonUnmarshalType or CamelJsonbUnmarshallType header during the 
unmarshalling. This should only be enabled when
+desired to be used. Default value: false
 ]]>
             </xs:documentation>
           </xs:annotation>
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd
index ff2894bcd3c2..31d1d2edabc6 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd
@@ -8466,8 +8466,9 @@ SerializationFeature.WRAP_ROOT_VALUE) to tell apart 
features with the same name.
           <xs:annotation>
             <xs:documentation xml:lang="en">
 <![CDATA[
-If enabled then Jackson is allowed to attempt to use the 
CamelJacksonUnmarshalType header during the unmarshalling. This
-should only be enabled when desired to be used. Default value: false
+If enabled then Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType,
+CamelGsonUnmarshalType or CamelJsonbUnmarshallType header during the 
unmarshalling. This should only be enabled when
+desired to be used. Default value: false
 ]]>
             </xs:documentation>
           </xs:annotation>
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camelYamlDsl-model.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camelYamlDsl-model.json
index e192cce0e155..eb325789ff7a 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camelYamlDsl-model.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camelYamlDsl-model.json
@@ -12703,7 +12703,7 @@
       }, {
         "name" : "allowUnmarshallType",
         "type" : "boolean",
-        "description" : "If enabled then Jackson is allowed to attempt to use 
the CamelJacksonUnmarshalType header during the unmarshalling. This should only 
be enabled when desired to be used.",
+        "description" : "If enabled then Jackson, Gson or JSON-B is allowed to 
attempt to use the CamelJacksonUnmarshalType, CamelGsonUnmarshalType or 
CamelJsonbUnmarshallType header during the unmarshalling. This should only be 
enabled when desired to be used.",
         "title" : "Allow Unmarshall Type",
         "default" : "false",
         "displayName" : "Allow Unmarshall Type",
diff --git 
a/components/camel-gson/src/generated/java/org/apache/camel/component/gson/GsonDataFormatConfigurer.java
 
b/components/camel-gson/src/generated/java/org/apache/camel/component/gson/GsonDataFormatConfigurer.java
index bffb803432d7..2652e95569aa 100644
--- 
a/components/camel-gson/src/generated/java/org/apache/camel/component/gson/GsonDataFormatConfigurer.java
+++ 
b/components/camel-gson/src/generated/java/org/apache/camel/component/gson/GsonDataFormatConfigurer.java
@@ -22,6 +22,7 @@ public class GsonDataFormatConfigurer extends 
org.apache.camel.support.component
     private static final Map<String, Object> ALL_OPTIONS;
     static {
         Map<String, Object> map = new CaseInsensitiveMap();
+        map.put("AllowUnmarshallType", boolean.class);
         map.put("ContentTypeHeader", boolean.class);
         map.put("DateFormatPattern", java.lang.String.class);
         map.put("PrettyPrint", boolean.class);
@@ -33,6 +34,8 @@ public class GsonDataFormatConfigurer extends 
org.apache.camel.support.component
     public boolean configure(CamelContext camelContext, Object obj, String 
name, Object value, boolean ignoreCase) {
         GsonDataFormat target = (GsonDataFormat) obj;
         switch (ignoreCase ? name.toLowerCase() : name) {
+        case "allowunmarshalltype":
+        case "allowUnmarshallType": 
target.setAllowUnmarshallType(property(camelContext, boolean.class, value)); 
return true;
         case "contenttypeheader":
         case "contentTypeHeader": 
target.setContentTypeHeader(property(camelContext, boolean.class, value)); 
return true;
         case "dateformatpattern":
@@ -53,6 +56,8 @@ public class GsonDataFormatConfigurer extends 
org.apache.camel.support.component
     @Override
     public Class<?> getOptionType(String name, boolean ignoreCase) {
         switch (ignoreCase ? name.toLowerCase() : name) {
+        case "allowunmarshalltype":
+        case "allowUnmarshallType": return boolean.class;
         case "contenttypeheader":
         case "contentTypeHeader": return boolean.class;
         case "dateformatpattern":
@@ -69,6 +74,8 @@ public class GsonDataFormatConfigurer extends 
org.apache.camel.support.component
     public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         GsonDataFormat target = (GsonDataFormat) obj;
         switch (ignoreCase ? name.toLowerCase() : name) {
+        case "allowunmarshalltype":
+        case "allowUnmarshallType": return target.isAllowUnmarshallType();
         case "contenttypeheader":
         case "contentTypeHeader": return target.isContentTypeHeader();
         case "dateformatpattern":
diff --git 
a/components/camel-gson/src/generated/resources/META-INF/org/apache/camel/component/gson/gson.json
 
b/components/camel-gson/src/generated/resources/META-INF/org/apache/camel/component/gson/gson.json
index bb860f0bafee..b1b147bfa11d 100644
--- 
a/components/camel-gson/src/generated/resources/META-INF/org/apache/camel/component/gson/gson.json
+++ 
b/components/camel-gson/src/generated/resources/META-INF/org/apache/camel/component/gson/gson.json
@@ -18,7 +18,8 @@
   "properties": {
     "prettyPrint": { "index": 0, "kind": "attribute", "displayName": "Pretty 
Print", "group": "common", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "To enable pretty printing output nicely 
formatted. Is by default false." },
     "unmarshalType": { "index": 1, "kind": "attribute", "displayName": 
"Unmarshal Type", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "Class name of the java type to use when 
unmarshalling." },
-    "contentTypeHeader": { "index": 2, "kind": "attribute", "displayName": 
"Content Type Header", "group": "common", "required": false, "type": "boolean", 
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "Whether the data format 
should set the Content-Type header with the type from the data format. For 
example application\/xml for data formats marshalling to XML, or 
application\/json for data formats marshalli [...]
-    "dateFormatPattern": { "index": 3, "kind": "attribute", "displayName": 
"Date Format Pattern", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "To configure the date format while marshall or 
unmarshall Date fields in JSON using Gson" }
+    "allowUnmarshallType": { "index": 2, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only be [...]
+    "contentTypeHeader": { "index": 3, "kind": "attribute", "displayName": 
"Content Type Header", "group": "common", "required": false, "type": "boolean", 
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "Whether the data format 
should set the Content-Type header with the type from the data format. For 
example application\/xml for data formats marshalling to XML, or 
application\/json for data formats marshalli [...]
+    "dateFormatPattern": { "index": 4, "kind": "attribute", "displayName": 
"Date Format Pattern", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "To configure the date format while marshall or 
unmarshall Date fields in JSON using Gson" }
   }
 }
diff --git 
a/components/camel-gson/src/main/java/org/apache/camel/component/gson/GsonDataFormat.java
 
b/components/camel-gson/src/main/java/org/apache/camel/component/gson/GsonDataFormat.java
index 2b68154a8acb..8cec81eb4c78 100644
--- 
a/components/camel-gson/src/main/java/org/apache/camel/component/gson/GsonDataFormat.java
+++ 
b/components/camel-gson/src/main/java/org/apache/camel/component/gson/GsonDataFormat.java
@@ -50,7 +50,7 @@ import org.apache.camel.util.IOHelper;
  * Marshal POJOs to JSON and back using <a 
href="http://code.google.com/p/google-gson/";>Gson</a>
  */
 @Dataformat("gson")
-@Metadata(includeProperties = 
"unmarshalType,unmarshalTypeName,prettyPrint,dateFormatPattern,contentTypeHeader")
+@Metadata(includeProperties = 
"unmarshalType,unmarshalTypeName,prettyPrint,dateFormatPattern,contentTypeHeader,allowUnmarshallType")
 public class GsonDataFormat extends ServiceSupport
         implements DataFormat, DataFormatName, DataFormatContentTypeHeader, 
CamelContextAware {
 
@@ -58,6 +58,7 @@ public class GsonDataFormat extends ServiceSupport
     private Gson gson;
     private Class<?> unmarshalType;
     private String unmarshalTypeName;
+    private boolean allowUnmarshallType;
     private Type unmarshalGenericType;
     private List<ExclusionStrategy> exclusionStrategies;
     private LongSerializationPolicy longSerializationPolicy;
@@ -167,7 +168,10 @@ public class GsonDataFormat extends ServiceSupport
     @Override
     public Object unmarshal(Exchange exchange, Object body) throws Exception {
         Class<?> clazz = unmarshalType;
-        String type = exchange.getIn().getHeader(GsonConstants.UNMARSHAL_TYPE, 
String.class);
+        String type = null;
+        if (allowUnmarshallType) {
+            type = exchange.getIn().getHeader(GsonConstants.UNMARSHAL_TYPE, 
String.class);
+        }
         if (type != null) {
             clazz = 
exchange.getContext().getClassResolver().resolveMandatoryClass(type);
         }
@@ -263,6 +267,19 @@ public class GsonDataFormat extends ServiceSupport
         this.unmarshalTypeName = unmarshalTypeName;
     }
 
+    public boolean isAllowUnmarshallType() {
+        return allowUnmarshallType;
+    }
+
+    /**
+     * If enabled then Gson is allowed to attempt to use the 
CamelGsonUnmarshalType header during the unmarshalling.
+     * <p/>
+     * This should only be enabled when desired to be used.
+     */
+    public void setAllowUnmarshallType(boolean allowUnmarshallType) {
+        this.allowUnmarshallType = allowUnmarshallType;
+    }
+
     public Type getUnmarshalGenericType() {
         return this.unmarshalGenericType;
     }
diff --git 
a/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonDataFormatTest.java
 
b/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonDataFormatTest.java
index 8aedcd8608a9..8626aef07e08 100644
--- 
a/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonDataFormatTest.java
+++ 
b/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonDataFormatTest.java
@@ -19,28 +19,19 @@ package org.apache.camel.component.gson;
 import java.util.*;
 
 import org.apache.camel.Exchange;
-import org.apache.camel.Message;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 public class GsonDataFormatTest {
 
+    // the exchange is not read: the unmarshal type header is only used with 
allowUnmarshallType
     @Mock
     private Exchange exchange;
-    @Mock
-    private Message message;
-
-    @BeforeEach
-    public void setup() {
-        when(exchange.getIn()).thenReturn(message);
-    }
 
     @Test
     public void testString() throws Exception {
diff --git 
a/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
 
b/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
index 2885973311f7..d74b899cf1ee 100644
--- 
a/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
+++ 
b/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
@@ -16,12 +16,16 @@
  */
 package org.apache.camel.component.gson;
 
+import java.util.Map;
+
 import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.model.dataformat.JsonDataFormat;
 import org.apache.camel.model.dataformat.JsonLibrary;
 import org.apache.camel.test.junit6.CamelTestSupport;
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 
 public class GsonUnmarshalTypeFromHeaderTest extends CamelTestSupport {
@@ -36,12 +40,23 @@ public class GsonUnmarshalTypeFromHeaderTest extends 
CamelTestSupport {
         assertEquals("my-name", pojo.getName());
     }
 
+    @Test
+    void testUnmarshalTypeFromHeaderIsIgnoredByDefault() {
+        String body = "{\"name\":\"my-name\"}";
+        Object result = 
template.requestBodyAndHeader("direct:unmarshalTypeFromHeaderNotAllowed", body,
+                GsonConstants.UNMARSHAL_TYPE, 
"org.apache.camel.component.gson.TestPojo");
+
+        assertInstanceOf(Map.class, result);
+    }
+
     @Override
     protected RouteBuilder createRouteBuilder() {
         return new RouteBuilder() {
             @Override
             public void configure() {
-                
from("direct:unmarshalTypeFromHeader").unmarshal().json(JsonLibrary.Gson);
+                from("direct:unmarshalTypeFromHeader")
+                        .unmarshal(new 
JsonDataFormat(JsonLibrary.Gson).allowUnmarshallType(true));
+                
from("direct:unmarshalTypeFromHeaderNotAllowed").unmarshal().json(JsonLibrary.Gson);
             }
         };
     }
diff --git 
a/components/camel-gson/src/test/resources/org/apache/camel/component/gson/SpringGsonUnmarshalTypeFromHeaderTest.xml
 
b/components/camel-gson/src/test/resources/org/apache/camel/component/gson/SpringGsonUnmarshalTypeFromHeaderTest.xml
index 621540eae4a2..2a2d67b8dfb1 100644
--- 
a/components/camel-gson/src/test/resources/org/apache/camel/component/gson/SpringGsonUnmarshalTypeFromHeaderTest.xml
+++ 
b/components/camel-gson/src/test/resources/org/apache/camel/component/gson/SpringGsonUnmarshalTypeFromHeaderTest.xml
@@ -33,7 +33,7 @@
                 <constant>org.apache.camel.component.gson.TestPojo</constant>
             </setHeader>
             <unmarshal>
-                <json library="Gson" />
+                <json library="Gson" allowUnmarshallType="true"/>
             </unmarshal>
         </route>
 
diff --git 
a/components/camel-jackson/src/generated/resources/META-INF/org/apache/camel/component/jackson/jackson.json
 
b/components/camel-jackson/src/generated/resources/META-INF/org/apache/camel/component/jackson/jackson.json
index b5d55379b432..60f4d41e2401 100644
--- 
a/components/camel-jackson/src/generated/resources/META-INF/org/apache/camel/component/jackson/jackson.json
+++ 
b/components/camel-jackson/src/generated/resources/META-INF/org/apache/camel/component/jackson/jackson.json
@@ -32,7 +32,7 @@
     "moduleRefs": { "index": 13, "kind": "attribute", "displayName": "Module 
Refs", "group": "advanced", "label": "advanced", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use custom Jackson modules referred 
from the Camel registry. Multiple modules can be separated by comma." },
     "enableFeatures": { "index": 14, "kind": "attribute", "displayName": 
"Enable Features", "group": "advanced", "label": "advanced", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to enable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. Seri [...]
     "disableFeatures": { "index": 15, "kind": "attribute", "displayName": 
"Disable Features", "group": "advanced", "label": "advanced", "required": 
false, "type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to disable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. S [...]
-    "allowUnmarshallType": { "index": 16, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson is allowed to attempt to use the CamelJacksonUnmarshalType header 
during the unmarshalling. This should only be enabled when desired to be used." 
},
+    "allowUnmarshallType": { "index": 16, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only b [...]
     "timezone": { "index": 17, "kind": "attribute", "displayName": "Timezone", 
"group": "advanced", "label": "advanced", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "If set then Jackson will use the Timezone when 
marshalling\/unmarshalling." },
     "schemaResolver": { "index": 18, "kind": "attribute", "displayName": 
"Schema Resolver", "group": "advanced", "label": "advanced", "required": false, 
"type": "object", "javaType": 
"org.apache.camel.component.jackson.SchemaResolver", "deprecated": false, 
"autowired": false, "secret": false, "description": "Optional schema resolver 
used to lookup schemas for the data in transit." },
     "autoDiscoverSchemaResolver": { "index": 19, "kind": "attribute", 
"displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": 
"advanced", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": true, "description": "When not disabled, the SchemaResolver 
will be looked up into the registry." },
diff --git 
a/components/camel-jackson3/src/generated/resources/META-INF/org/apache/camel/component/jackson3/jackson.json
 
b/components/camel-jackson3/src/generated/resources/META-INF/org/apache/camel/component/jackson3/jackson.json
index fe588f1d3fad..e20b425d4f77 100644
--- 
a/components/camel-jackson3/src/generated/resources/META-INF/org/apache/camel/component/jackson3/jackson.json
+++ 
b/components/camel-jackson3/src/generated/resources/META-INF/org/apache/camel/component/jackson3/jackson.json
@@ -32,7 +32,7 @@
     "moduleRefs": { "index": 13, "kind": "attribute", "displayName": "Module 
Refs", "group": "advanced", "label": "advanced", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use custom Jackson modules referred 
from the Camel registry. Multiple modules can be separated by comma." },
     "enableFeatures": { "index": 14, "kind": "attribute", "displayName": 
"Enable Features", "group": "advanced", "label": "advanced", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to enable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. Seri [...]
     "disableFeatures": { "index": 15, "kind": "attribute", "displayName": 
"Disable Features", "group": "advanced", "label": "advanced", "required": 
false, "type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to disable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. S [...]
-    "allowUnmarshallType": { "index": 16, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson is allowed to attempt to use the CamelJacksonUnmarshalType header 
during the unmarshalling. This should only be enabled when desired to be used." 
},
+    "allowUnmarshallType": { "index": 16, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only b [...]
     "timezone": { "index": 17, "kind": "attribute", "displayName": "Timezone", 
"group": "advanced", "label": "advanced", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "If set then Jackson will use the Timezone when 
marshalling\/unmarshalling." },
     "schemaResolver": { "index": 18, "kind": "attribute", "displayName": 
"Schema Resolver", "group": "advanced", "label": "advanced", "required": false, 
"type": "object", "javaType": 
"org.apache.camel.component.jackson.SchemaResolver", "deprecated": false, 
"autowired": false, "secret": false, "description": "Optional schema resolver 
used to lookup schemas for the data in transit." },
     "autoDiscoverSchemaResolver": { "index": 19, "kind": "attribute", 
"displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": 
"advanced", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": true, "description": "When not disabled, the SchemaResolver 
will be looked up into the registry." },
diff --git 
a/components/camel-jsonb/src/generated/java/org/apache/camel/component/jsonb/JsonbDataFormatConfigurer.java
 
b/components/camel-jsonb/src/generated/java/org/apache/camel/component/jsonb/JsonbDataFormatConfigurer.java
index 174615fc22d1..bb978381ec23 100644
--- 
a/components/camel-jsonb/src/generated/java/org/apache/camel/component/jsonb/JsonbDataFormatConfigurer.java
+++ 
b/components/camel-jsonb/src/generated/java/org/apache/camel/component/jsonb/JsonbDataFormatConfigurer.java
@@ -22,6 +22,7 @@ public class JsonbDataFormatConfigurer extends 
org.apache.camel.support.componen
     private static final Map<String, Object> ALL_OPTIONS;
     static {
         Map<String, Object> map = new CaseInsensitiveMap();
+        map.put("AllowUnmarshallType", boolean.class);
         map.put("ObjectMapper", jakarta.json.bind.Jsonb.class);
         map.put("PrettyPrint", boolean.class);
         map.put("UnmarshalType", java.lang.Class.class);
@@ -32,6 +33,8 @@ public class JsonbDataFormatConfigurer extends 
org.apache.camel.support.componen
     public boolean configure(CamelContext camelContext, Object obj, String 
name, Object value, boolean ignoreCase) {
         JsonbDataFormat target = (JsonbDataFormat) obj;
         switch (ignoreCase ? name.toLowerCase() : name) {
+        case "allowunmarshalltype":
+        case "allowUnmarshallType": 
target.setAllowUnmarshallType(property(camelContext, boolean.class, value)); 
return true;
         case "objectmapper":
         case "objectMapper": target.setObjectMapper(property(camelContext, 
jakarta.json.bind.Jsonb.class, value)); return true;
         case "prettyprint":
@@ -50,6 +53,8 @@ public class JsonbDataFormatConfigurer extends 
org.apache.camel.support.componen
     @Override
     public Class<?> getOptionType(String name, boolean ignoreCase) {
         switch (ignoreCase ? name.toLowerCase() : name) {
+        case "allowunmarshalltype":
+        case "allowUnmarshallType": return boolean.class;
         case "objectmapper":
         case "objectMapper": return jakarta.json.bind.Jsonb.class;
         case "prettyprint":
@@ -64,6 +69,8 @@ public class JsonbDataFormatConfigurer extends 
org.apache.camel.support.componen
     public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         JsonbDataFormat target = (JsonbDataFormat) obj;
         switch (ignoreCase ? name.toLowerCase() : name) {
+        case "allowunmarshalltype":
+        case "allowUnmarshallType": return target.isAllowUnmarshallType();
         case "objectmapper":
         case "objectMapper": return target.getObjectMapper();
         case "prettyprint":
diff --git 
a/components/camel-jsonb/src/generated/resources/META-INF/org/apache/camel/component/jsonb/jsonb.json
 
b/components/camel-jsonb/src/generated/resources/META-INF/org/apache/camel/component/jsonb/jsonb.json
index 82e39121c12c..d89137d9303a 100644
--- 
a/components/camel-jsonb/src/generated/resources/META-INF/org/apache/camel/component/jsonb/jsonb.json
+++ 
b/components/camel-jsonb/src/generated/resources/META-INF/org/apache/camel/component/jsonb/jsonb.json
@@ -18,6 +18,7 @@
   "properties": {
     "objectMapper": { "index": 0, "kind": "attribute", "displayName": "Jsonb 
instance", "group": "common", "required": false, "type": "string", "javaType": 
"java.lang.String", "deprecated": false, "autowired": false, "secret": false, 
"description": "Lookup and use the existing Jsonb instance with the given id." 
},
     "prettyPrint": { "index": 1, "kind": "attribute", "displayName": "Pretty 
Print", "group": "common", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "To enable pretty printing output nicely 
formatted. Is by default false." },
-    "unmarshalType": { "index": 2, "kind": "attribute", "displayName": 
"Unmarshal Type", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "Class name of the java type to use when 
unmarshalling." }
+    "unmarshalType": { "index": 2, "kind": "attribute", "displayName": 
"Unmarshal Type", "group": "common", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "Class name of the java type to use when 
unmarshalling." },
+    "allowUnmarshallType": { "index": 3, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only be [...]
   }
 }
diff --git 
a/components/camel-jsonb/src/main/java/org/apache/camel/component/jsonb/JsonbDataFormat.java
 
b/components/camel-jsonb/src/main/java/org/apache/camel/component/jsonb/JsonbDataFormat.java
index 22ce4dbf9a9a..c1f72ebcfa7d 100644
--- 
a/components/camel-jsonb/src/main/java/org/apache/camel/component/jsonb/JsonbDataFormat.java
+++ 
b/components/camel-jsonb/src/main/java/org/apache/camel/component/jsonb/JsonbDataFormat.java
@@ -43,8 +43,14 @@ import org.apache.camel.support.service.ServiceSupport;
  * Marshal POJOs to JSON and back using JSON-B.
  */
 @Dataformat("jsonb")
-@Metadata(includeProperties = 
"unmarshalTypeName,unmarshalType,objectMapper,prettyPrint,binaryStrategy,encoding,propertyOrder,propertyNamingStrategy,skipNull")
+@Metadata(includeProperties = 
"unmarshalTypeName,unmarshalType,objectMapper,prettyPrint,binaryStrategy,encoding,propertyOrder,propertyNamingStrategy,skipNull,allowUnmarshallType")
 public class JsonbDataFormat extends ServiceSupport implements DataFormat, 
DataFormatName, CamelContextAware {
+
+    /**
+     * The header with the name of the class to unmarshal to, used when 
allowUnmarshallType is enabled.
+     */
+    public static final String UNMARSHAL_TYPE = "CamelJsonbUnmarshallType";
+
     private CamelContext camelContext;
     private Jsonb objectMapper;
     private String unmarshalTypeName;
@@ -56,6 +62,7 @@ public class JsonbDataFormat extends ServiceSupport 
implements DataFormat, DataF
     private String propertyOrder = PropertyOrderStrategy.ANY;
     private String propertyNamingStrategy = PropertyNamingStrategy.IDENTITY;
     private boolean skipNull = true;
+    private boolean allowUnmarshallType;
 
     public JsonbDataFormat() {
         this(Object.class);
@@ -157,6 +164,19 @@ public class JsonbDataFormat extends ServiceSupport 
implements DataFormat, DataF
         this.skipNull = skipNull;
     }
 
+    public boolean isAllowUnmarshallType() {
+        return allowUnmarshallType;
+    }
+
+    /**
+     * If enabled then JSON-B is allowed to attempt to use the 
CamelJsonbUnmarshallType header during the unmarshalling.
+     * <p/>
+     * This should only be enabled when desired to be used.
+     */
+    public void setAllowUnmarshallType(boolean allowUnmarshallType) {
+        this.allowUnmarshallType = allowUnmarshallType;
+    }
+
     public String getBinaryStrategy() {
         return binaryStrategy;
     }
@@ -203,7 +223,10 @@ public class JsonbDataFormat extends ServiceSupport 
implements DataFormat, DataF
     public Object unmarshal(Exchange exchange, Object body) throws Exception {
         // is there a header with the unmarshal type?
         Class<?> expectedType = unmarshalType;
-        String type = exchange.getIn().getHeader("CamelJsonbUnmarshallType", 
String.class);
+        String type = null;
+        if (allowUnmarshallType) {
+            type = exchange.getIn().getHeader(UNMARSHAL_TYPE, String.class);
+        }
         if (type != null) {
             expectedType = 
exchange.getContext().getClassResolver().resolveMandatoryClass(type);
         }
diff --git 
a/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
 
b/components/camel-jsonb/src/test/java/org/apache/camel/component/jsonb/JsonbUnmarshalTypeFromHeaderTest.java
similarity index 53%
copy from 
components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
copy to 
components/camel-jsonb/src/test/java/org/apache/camel/component/jsonb/JsonbUnmarshalTypeFromHeaderTest.java
index 2885973311f7..9cad958a3567 100644
--- 
a/components/camel-gson/src/test/java/org/apache/camel/component/gson/GsonUnmarshalTypeFromHeaderTest.java
+++ 
b/components/camel-jsonb/src/test/java/org/apache/camel/component/jsonb/JsonbUnmarshalTypeFromHeaderTest.java
@@ -14,36 +14,51 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.camel.component.gson;
+package org.apache.camel.component.jsonb;
+
+import java.util.Map;
 
 import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.model.dataformat.JsonDataFormat;
 import org.apache.camel.model.dataformat.JsonLibrary;
 import org.apache.camel.test.junit6.CamelTestSupport;
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+
+/**
+ * The CamelJsonbUnmarshallType header only selects the unmarshal type when 
allowUnmarshallType is enabled.
+ */
+class JsonbUnmarshalTypeFromHeaderTest extends CamelTestSupport {
 
-public class GsonUnmarshalTypeFromHeaderTest extends CamelTestSupport {
+    private static final String BODY = "{\"name\":\"my-name\"}";
 
     @Test
-    public void testUnmarshalTypeFromHeader() {
-        String body = "{\"name\":\"my-name\"}";
-        String unmarshallType = "org.apache.camel.component.gson.TestPojo";
-        TestPojo pojo = 
template.requestBodyAndHeader("direct:unmarshalTypeFromHeader", body, 
GsonConstants.UNMARSHAL_TYPE,
-                unmarshallType, TestPojo.class);
-        assertNotNull(pojo);
+    void unmarshalTypeFromHeaderWhenAllowed() {
+        Object result = template.requestBodyAndHeader("direct:allowed", BODY, 
JsonbDataFormat.UNMARSHAL_TYPE,
+                TestPojo.class.getName());
+
+        TestPojo pojo = assertInstanceOf(TestPojo.class, result);
         assertEquals("my-name", pojo.getName());
     }
 
+    @Test
+    void unmarshalTypeFromHeaderIsIgnoredByDefault() {
+        Object result = template.requestBodyAndHeader("direct:default", BODY, 
JsonbDataFormat.UNMARSHAL_TYPE,
+                TestPojo.class.getName());
+
+        assertInstanceOf(Map.class, result);
+    }
+
     @Override
     protected RouteBuilder createRouteBuilder() {
         return new RouteBuilder() {
             @Override
             public void configure() {
-                
from("direct:unmarshalTypeFromHeader").unmarshal().json(JsonLibrary.Gson);
+                from("direct:allowed").unmarshal(new 
JsonDataFormat(JsonLibrary.Jsonb).allowUnmarshallType(true));
+                from("direct:default").unmarshal().json(JsonLibrary.Jsonb);
             }
         };
     }
-
 }
diff --git 
a/core/camel-core-model/src/generated/resources/META-INF/org/apache/camel/model/dataformat/json.json
 
b/core/camel-core-model/src/generated/resources/META-INF/org/apache/camel/model/dataformat/json.json
index ebabe678aede..5a0e55ee5d3a 100644
--- 
a/core/camel-core-model/src/generated/resources/META-INF/org/apache/camel/model/dataformat/json.json
+++ 
b/core/camel-core-model/src/generated/resources/META-INF/org/apache/camel/model/dataformat/json.json
@@ -29,7 +29,7 @@
     "moduleRefs": { "index": 14, "kind": "attribute", "displayName": "Module 
Refs", "group": "advanced", "label": "advanced", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use custom Jackson modules referred 
from the Camel registry. Multiple modules can be separated by comma." },
     "enableFeatures": { "index": 15, "kind": "attribute", "displayName": 
"Enable Features", "group": "advanced", "label": "advanced", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to enable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. Seri [...]
     "disableFeatures": { "index": 16, "kind": "attribute", "displayName": 
"Disable Features", "group": "advanced", "label": "advanced", "required": 
false, "type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "description": "Set of features to disable 
on the Jackson com.fasterxml.jackson.databind.ObjectMapper. Multiple features 
can be separated by comma. When using Jackson 3, a feature can be qualified 
with its enum class name (e.g. S [...]
-    "allowUnmarshallType": { "index": 17, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson is allowed to attempt to use the CamelJacksonUnmarshalType header 
during the unmarshalling. This should only be enabled when desired to be used." 
},
+    "allowUnmarshallType": { "index": 17, "kind": "attribute", "displayName": 
"Allow Unmarshall Type", "group": "common", "required": false, "type": 
"boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If enabled then 
Jackson, Gson or JSON-B is allowed to attempt to use the 
CamelJacksonUnmarshalType, CamelGsonUnmarshalType or CamelJsonbUnmarshallType 
header during the unmarshalling. This should only b [...]
     "timezone": { "index": 18, "kind": "attribute", "displayName": "Timezone", 
"group": "advanced", "label": "advanced", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "If set then Jackson will use the Timezone when 
marshalling\/unmarshalling." },
     "schemaResolver": { "index": 19, "kind": "attribute", "displayName": 
"Schema Resolver", "group": "advanced", "label": "advanced", "required": false, 
"type": "object", "javaType": 
"org.apache.camel.component.jackson.SchemaResolver", "deprecated": false, 
"autowired": false, "secret": false, "description": "Optional schema resolver 
used to lookup schemas for the data in transit." },
     "autoDiscoverSchemaResolver": { "index": 20, "kind": "attribute", 
"displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": 
"advanced", "required": false, "type": "boolean", "javaType": 
"java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": true, "description": "When not disabled, the SchemaResolver 
will be looked up into the registry." },
diff --git 
a/core/camel-core-model/src/main/java/org/apache/camel/model/dataformat/JsonDataFormat.java
 
b/core/camel-core-model/src/main/java/org/apache/camel/model/dataformat/JsonDataFormat.java
index 76a92bbb0b45..d062ff1ab820 100644
--- 
a/core/camel-core-model/src/main/java/org/apache/camel/model/dataformat/JsonDataFormat.java
+++ 
b/core/camel-core-model/src/main/java/org/apache/camel/model/dataformat/JsonDataFormat.java
@@ -110,7 +110,8 @@ public class JsonDataFormat extends DataFormatDefinition 
implements ContentTypeH
     private String disableFeatures;
     @XmlAttribute
     @Metadata(javaType = "java.lang.Boolean",
-              description = "If enabled then Jackson is allowed to attempt to 
use the CamelJacksonUnmarshalType header during the unmarshalling."
+              description = "If enabled then Jackson, Gson or JSON-B is 
allowed to attempt to use the CamelJacksonUnmarshalType,"
+                            + " CamelGsonUnmarshalType or 
CamelJsonbUnmarshallType header during the unmarshalling."
                             + " This should only be enabled when desired to be 
used.")
     private String allowUnmarshallType;
     @XmlAttribute
@@ -839,8 +840,8 @@ public class JsonDataFormat extends DataFormatDefinition 
implements ContentTypeH
         }
 
         /**
-         * If enabled then Jackson is allowed to attempt to use the 
CamelJacksonUnmarshalType header during the
-         * unmarshalling.
+         * If enabled then Jackson, Gson or JSON-B is allowed to attempt to 
use the CamelJacksonUnmarshalType,
+         * CamelGsonUnmarshalType or CamelJsonbUnmarshallType header during 
the unmarshalling.
          * <p/>
          * This should only be enabled when desired to be used.
          */
@@ -850,8 +851,8 @@ public class JsonDataFormat extends DataFormatDefinition 
implements ContentTypeH
         }
 
         /**
-         * If enabled then Jackson is allowed to attempt to use the 
CamelJacksonUnmarshalType header during the
-         * unmarshalling.
+         * If enabled then Jackson, Gson or JSON-B is allowed to attempt to 
use the CamelJacksonUnmarshalType,
+         * CamelGsonUnmarshalType or CamelJsonbUnmarshallType header during 
the unmarshalling.
          * <p/>
          * This should only be enabled when desired to be used.
          */
diff --git 
a/core/camel-core-reifier/src/main/java/org/apache/camel/reifier/dataformat/JsonDataFormatReifier.java
 
b/core/camel-core-reifier/src/main/java/org/apache/camel/reifier/dataformat/JsonDataFormatReifier.java
index 14dd6e68a85a..3275f1e35b84 100644
--- 
a/core/camel-core-reifier/src/main/java/org/apache/camel/reifier/dataformat/JsonDataFormatReifier.java
+++ 
b/core/camel-core-reifier/src/main/java/org/apache/camel/reifier/dataformat/JsonDataFormatReifier.java
@@ -64,6 +64,9 @@ public class JsonDataFormatReifier extends 
DataFormatReifier<JsonDataFormat> {
         if (definition.getLibrary() == JsonLibrary.Jsonb) {
             properties.put("objectMapper", 
asRef(definition.getObjectMapper()));
         }
+        if (definition.getLibrary() == JsonLibrary.Gson || 
definition.getLibrary() == JsonLibrary.Jsonb) {
+            properties.put("allowUnmarshallType", 
definition.getAllowUnmarshallType());
+        }
         if (definition.getLibrary() == JsonLibrary.Fastjson || 
definition.getLibrary() == JsonLibrary.Gson) {
             properties.put("dateFormatPattern", 
definition.getDateFormatPattern());
         }
diff --git a/docs/user-manual/modules/ROOT/attachments/security-model.yaml 
b/docs/user-manual/modules/ROOT/attachments/security-model.yaml
index b7eb31b723a2..441cac587e0e 100644
--- a/docs/user-manual/modules/ROOT/attachments/security-model.yaml
+++ b/docs/user-manual/modules/ROOT/attachments/security-model.yaml
@@ -156,6 +156,9 @@ config_variants:
     - option: logPhi                        # camel-mllp
       insecure_value: true
       default: false                 # CVE-2026-85260
+    - option: allowUnmarshallType           # camel-jackson, camel-gson, 
camel-jsonb
+      insecure_value: true
+      default: false                 # CVE-2016-8749 (Jackson); the unmarshal 
type header selects the class
 
 properties_provided:
   # id, violation symptom, indicative severity tier (the range published at 
the advisory index since 2015)
diff --git 
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc 
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index df6c80a2e330..56e5ff0a682a 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -215,6 +215,15 @@ which embeds its own relocated copy of Vert.x. The `vertx` 
option of `camel-aran
 See the 
https://github.com/fabric8io/kubernetes-client/blob/main/doc/MIGRATION-v8.md[Kubernetes
 client 8 migration guide]
 for the other changes.
 
+=== camel-gson, camel-jsonb - the unmarshal type header needs 
allowUnmarshallType
+
+The Gson and JSON-B data formats now use the `CamelGsonUnmarshalType` and 
`CamelJsonbUnmarshallType` headers to choose
+the class to unmarshal to only when the new `allowUnmarshallType` option is 
enabled, as the Jackson data formats do with
+`CamelJacksonUnmarshalType`. By default the headers are ignored, and the 
configured `unmarshalType` is used (a `Map` for
+a JSON object when none is configured). A route that sets the header must 
enable the option, for example with
+`.unmarshal(new JsonDataFormat(JsonLibrary.Gson).allowUnmarshallType(true))` or
+`<json library="Gson" allowUnmarshallType="true"/>`.
+
 === camel-jbang - camel validate and camel overview report the same endpoints 
no route consumes
 
 `camel validate source` and `camel overview` now use the same rules for a 
`direct:`, `seda:` or `disruptor:` endpoint
diff --git a/docs/user-manual/modules/ROOT/pages/security-model.adoc 
b/docs/user-manual/modules/ROOT/pages/security-model.adoc
index a68cf6937d71..1d4ef5d782ff 100644
--- a/docs/user-manual/modules/ROOT/pages/security-model.adoc
+++ b/docs/user-manual/modules/ROOT/pages/security-model.adoc
@@ -1826,6 +1826,11 @@ explicit-opt-in entry under _Out of scope_.
 | `logPhi=true` (`camel-mllp`)
 | `false`
 | HL7 payload content is written to the log (CVE-2026-85260).
+
+| `allowUnmarshallType=true` (`camel-jackson`, `camel-gson`, `camel-jsonb`)
+| `false`
+| The `CamelJacksonUnmarshalType`, `CamelGsonUnmarshalType` or 
`CamelJsonbUnmarshallType` header selects the class
+  that the body is unmarshalled into (CVE-2016-8749 for Jackson).
 |===
 
 A machine-readable index of these variants, the entry-point trust levels, the
diff --git 
a/dsl/camel-yaml-dsl/camel-yaml-dsl-deserializers/src/generated/java/org/apache/camel/dsl/yaml/deserializers/ModelDeserializers.java
 
b/dsl/camel-yaml-dsl/camel-yaml-dsl-deserializers/src/generated/java/org/apache/camel/dsl/yaml/deserializers/ModelDeserializers.java
index 7af4dcfb6ed7..6f3bf69345d4 100644
--- 
a/dsl/camel-yaml-dsl/camel-yaml-dsl-deserializers/src/generated/java/org/apache/camel/dsl/yaml/deserializers/ModelDeserializers.java
+++ 
b/dsl/camel-yaml-dsl/camel-yaml-dsl-deserializers/src/generated/java/org/apache/camel/dsl/yaml/deserializers/ModelDeserializers.java
@@ -8190,7 +8190,7 @@ public final class ModelDeserializers extends 
YamlDeserializerSupport {
             deprecated = false,
             properties = {
                     @YamlProperty(name = "allowJmsType", type = "boolean", 
defaultValue = "false", description = "Used for JMS users to allow the JMSType 
header from the JMS spec to specify a FQN classname to use to unmarshal to.", 
displayName = "Allow Jms Type"),
-                    @YamlProperty(name = "allowUnmarshallType", type = 
"boolean", defaultValue = "false", description = "If enabled then Jackson is 
allowed to attempt to use the CamelJacksonUnmarshalType header during the 
unmarshalling. This should only be enabled when desired to be used.", 
displayName = "Allow Unmarshall Type"),
+                    @YamlProperty(name = "allowUnmarshallType", type = 
"boolean", defaultValue = "false", description = "If enabled then Jackson, Gson 
or JSON-B is allowed to attempt to use the CamelJacksonUnmarshalType, 
CamelGsonUnmarshalType or CamelJsonbUnmarshallType header during the 
unmarshalling. This should only be enabled when desired to be used.", 
displayName = "Allow Unmarshall Type"),
                     @YamlProperty(name = "autoDiscoverObjectMapper", type = 
"boolean", defaultValue = "false", description = "If set to true then Jackson 
will look for an objectMapper to use from the registry.", displayName = "Auto 
Discover Object Mapper"),
                     @YamlProperty(name = "autoDiscoverSchemaResolver", type = 
"boolean", defaultValue = "true", description = "When not disabled, the 
SchemaResolver will be looked up into the registry.", displayName = "Auto 
Discover Schema Resolver"),
                     @YamlProperty(name = "collectionType", type = "string", 
description = "Refers to a custom collection type to lookup in the registry to 
use. This option should rarely be used, but allows using different collection 
types than java.util.Collection based as default.", displayName = "Collection 
Type"),
diff --git 
a/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-canonical.json
 
b/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-canonical.json
index 1e48fcea66ad..9e21df5997f1 100644
--- 
a/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-canonical.json
+++ 
b/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-canonical.json
@@ -7921,7 +7921,7 @@
           "allowUnmarshallType" : {
             "type" : "boolean",
             "title" : "Allow Unmarshall Type",
-            "description" : "If enabled then Jackson is allowed to attempt to 
use the CamelJacksonUnmarshalType header during the unmarshalling. This should 
only be enabled when desired to be used.",
+            "description" : "If enabled then Jackson, Gson or JSON-B is 
allowed to attempt to use the CamelJacksonUnmarshalType, CamelGsonUnmarshalType 
or CamelJsonbUnmarshallType header during the unmarshalling. This should only 
be enabled when desired to be used.",
             "default" : false
           },
           "autoDiscoverObjectMapper" : {
diff --git 
a/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-model.json
 
b/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-model.json
index e192cce0e155..eb325789ff7a 100644
--- 
a/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-model.json
+++ 
b/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl-model.json
@@ -12703,7 +12703,7 @@
       }, {
         "name" : "allowUnmarshallType",
         "type" : "boolean",
-        "description" : "If enabled then Jackson is allowed to attempt to use 
the CamelJacksonUnmarshalType header during the unmarshalling. This should only 
be enabled when desired to be used.",
+        "description" : "If enabled then Jackson, Gson or JSON-B is allowed to 
attempt to use the CamelJacksonUnmarshalType, CamelGsonUnmarshalType or 
CamelJsonbUnmarshallType header during the unmarshalling. This should only be 
enabled when desired to be used.",
         "title" : "Allow Unmarshall Type",
         "default" : "false",
         "displayName" : "Allow Unmarshall Type",
diff --git 
a/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl.json
 
b/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl.json
index a06579e9c98b..1387bb3a2376 100644
--- 
a/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl.json
+++ 
b/dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl.json
@@ -10074,7 +10074,7 @@
           "allowUnmarshallType" : {
             "type" : "boolean",
             "title" : "Allow Unmarshall Type",
-            "description" : "If enabled then Jackson is allowed to attempt to 
use the CamelJacksonUnmarshalType header during the unmarshalling. This should 
only be enabled when desired to be used.",
+            "description" : "If enabled then Jackson, Gson or JSON-B is 
allowed to attempt to use the CamelJacksonUnmarshalType, CamelGsonUnmarshalType 
or CamelJsonbUnmarshallType header during the unmarshalling. This should only 
be enabled when desired to be used.",
             "default" : false
           },
           "autoDiscoverObjectMapper" : {

Reply via email to