Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 1 vendor · 1 advisory

CVE-2026-43867

CVE-2026-43867: 1 tracked advisory record across Apache. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityCritical9.8

    Critical [CVE-2026-40048 +2] Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component

    CVE-2026-43867Source published Source updated

    This bulletin covers 3 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a…

    Affected products in this advisory
    • Apache Camel PQC
    Source-reported affected versions
    • 4.18.0 through 4.18.3
    • 4.19.0 through 4.21.0.
    Source-reported fixed versions
    • 4.21.0
    • 4.18.3
    Mitigation guidance
    • Users are recommended to upgrade to version 4.21.0, which fixes the issue.
    • If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3.
    Workarounds
    • For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Apache CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features