Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-27172

CVE-2026-27172: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2024-22369 +3] Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

    CVE-2026-27172Source published Source updated

    This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This…

    Affected products in this advisory
    • Apache Camel
    Source-reported affected versions
    • Apache Camel 3.0.0 before 4.14.6
    • Apache Camel 4.15.0 before 4.18.1
    Source-reported fixed versions
    • 4.14.6
    • 4.18.1
    Mitigation guidance
    • Users are recommended to upgrade to version 4.19.0, which fixes the issue.
    • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
    • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-27172] Apache Camel camel-consul: Arbitrary code execution via deserialization of untrusted data

    CVE-2026-27172Source published

    Apache Camel camel-consul: Arbitrary code execution via deserialization of untrusted data. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.

    Related products — impact not confirmed
    • Red Hat Enterprise Linux
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features