CVE-2026-78165
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component
CVE-2026-78165: Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. Not in the CISA KEV catalog.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-78165 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 8.8 (Apache), 8.8 (Red Hat)
- Weakness
- CWE-502
- Fixed releases
- Apache: 4.18.5, 4.22.1, 4.23.0
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-78165; bulletin-wide values are not repeated here.
Is CVE-2026-78165 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-78165 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-78165?
Upgrade to a fixed release named by the vendor:
- Apache: 4.18.5, 4.22.1, 4.23.0
- Users are recommended to upgrade to version 4.23.0, which fixes the issue. (Apache)
- If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. (Apache)
Vendor advisory comparison
Apache
1 advisory- Advisory severityHigh8.8
High [CVE-2026-78165] Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component
CVE-2026-78165Source published Source updated
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the…
- Affected products in this advisory
- Apache Camel Spring
- Source-reported affected versions
- 2.11.0 before 4.18.5
- 4.19.0 before 4.22.1
- Source-reported fixed versions
- 4.18.5
- 4.22.1
- 4.23.0
- Mitigation guidance
- Users are recommended to upgrade to version 4.23.0, which fixes the issue.
- If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
- For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate.
- Workarounds
- As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.
Red Hat
1 advisory- Advisory severityHigh8.8
High [CVE-2026-78165] Arbitrary code execution via untrusted Java deserialization
CVE-2026-78165Source published Source updated
Arbitrary code execution via untrusted Java deserialization. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7.
- Related products — impact not confirmed
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Fuse 7
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.