Skip to content
VulniPulse
Sign in
Advisory severityMedium5.9Apache Software Foundation

Medium [CVE-2026-85248] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component

This medium-severity Apache Software Foundation advisory covers CVE-2026-85248 affecting Apache Camel PQC.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-85248 Source published Source updated

VulniPulse record published Record updated

CVE-2026-85248
Affected products & platforms
Apache Software FoundationMessaging
Open source advisory

Get an email when Apache Software Foundation publishes the next one.

VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

Summary

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.

This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.

The producer held a single java.security. Signature instance and used it for every exchange without synchronizing access.

Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state.

With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer.

The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.

The Signature instance is no longer shared across concurrent exchanges.

Affected versions
  • 4.12.0 before 4.18.5
  • 4.19.0 before 4.22.1

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Fixed versions
  • 4.18.5
  • 4.22.1

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state.
  • With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer.
  • Upgrade to Apache Camel 4.23.0, which fixes the issue.
  • Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
  • Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
Temporary workarounds
  • For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

More Apache Software Foundation advisories

All Apache Software Foundation advisories

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alertsSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.