CVE-2026-78162
CVE-2026-78162 is covered by the Apache CVE-2026-78162 security bulletin. Not in the CISA KEV catalog. Critical advisory severity. 1 advisory from Apache.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-78162 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- Vendor advisories
- 1 from Apache
- VulniPulse record
- Published · Updated
Is CVE-2026-78162 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-78162 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-78162?
This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.
Vendor advisory comparison
Apache
1 advisory- Advisory severityCritical10.0
Critical [CVE-2026-43865 +1] Deserialization of Untrusted Data vulnerability in Apache Camel
CVE-2026-78162Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- 4.0.0 before 4.18.5
- 4.19.0 before 4.22.1
- Source-reported fixed versions
- 4.18.5
- 4.22.1
- 4.23.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.23.0, which fixes the issue.
- If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
- For deployments that cannot upgrade immediately, supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance, since a user-supplied configuration is never overwritten by Camel.
- Workarounds
- ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction.
- Alternatively set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.