CVE-2026-25747
CVE-2026-25747: 4 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
3 advisories- Advisory severityHigh8.8
High [CVE-2024-22369 +3] Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store
CVE-2026-27172Source published Source updated
This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- Apache Camel 3.0.0 before 4.14.6
- Apache Camel 4.15.0 before 4.18.1
- Source-reported fixed versions
- 4.14.6
- 4.18.1
- Mitigation guidance
- Users are recommended to upgrade to version 4.19.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.
- Advisory severityHigh8.8
High [CVE-2024-22369 +3] Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository
CVE-2026-40858Source published Source updated
This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. The JIRA ticket: refers to…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- Apache Camel 4.0.0 before 4.14.7
- Apache Camel 4.15.0 before 4.18.2
- Apache Camel 4.19.0 before 4.20.0
- Source-reported fixed versions
- 4.14.7
- 4.18.2
- 4.20.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.20.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
- Advisory severityUnrated
Advisory [CVE-2026-25747] Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB
CVE-2026-25747Source published Source updated
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are…
- Affected products in this advisory
- Apache Camel LevelDB
- Source-reported affected versions
- Apache Camel LevelDB 3.0.0 before 4.10.9
- Apache Camel LevelDB 4.14.0 before 4.14.5
- Apache Camel LevelDB 4.15.0 before 4.18.0
- Source-reported fixed versions
- 4.10.9
- 4.14.5
- 4.18.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.18.0, which fixes the issue.
- For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5
Red Hat
1 advisory- Advisory severityHigh7.8
High [CVE-2026-25747] Arbitrary code execution via deserialization of untrusted data
CVE-2026-25747Source published
Arbitrary code execution via deserialization of untrusted data. Red Hat rates this important (CVSS 7.8). Weakness: CWE-502. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.
- Affected products in this advisory
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.