High [CVE-2026-78165] Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component
This high-severity Apache Software Foundation advisory covers CVE-2026-78165 affecting Apache Camel Spring.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.
This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.
RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs.
Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed.
RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly.
The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template.
- 2.11.0 before 4.18.5
- 4.19.0 before 4.22.1
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
- 4.18.5
- 4.22.1
- 4.23.0
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 4.23.0, which fixes the issue.
- If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
- For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate.
- As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.