Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary s
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft, Oracle
- Product
- exchange, java
- CVSS
- 8.8
- Exposure class
- Database, Web platform
Why it ranks 15 (Routine)
- CVSS 8.8 high
- Product class: database, web platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-78165 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.