Vulnerabilities

Deserialization of Untrusted Data vulnerability in Apache Camel.

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Microsoft, Oracle

Product

exchange, java

Exposure class

Web platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-78162 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 27d ago

   Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.

   CVSS 8.8 CVE-2026-88900 Microsoft Oracle
2. 15
   CVE NVD 27d ago

   Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.

   CVSS 8.8 CVE-2026-78165 Microsoft Oracle