Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-88900

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component

CVE-2026-88900: Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-88900 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
8.8 (Apache), 8.8 (Red Hat)
Weakness
CWE-502
Fixed releases
  • Apache: 4.18.5, 4.22.1, 4.23.0
Vendor advisories
2 from Apache, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-88900; bulletin-wide values are not repeated here.

Is CVE-2026-88900 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-88900 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-88900?

Upgrade to a fixed release named by the vendor:

  • Apache: 4.18.5, 4.22.1, 4.23.0
  • No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. (Apache)
  • Users are recommended to upgrade to version 4.23.0, which fixes the issue. (Apache)

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-88900] Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component

    CVE-2026-88900Source published Source updated

    Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups. Message.getObject(). No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is…

    Affected products in this advisory
    • Apache Camel Camel-Jgroups
    Source-reported affected versions
    • 4.0.0 before 4.18.5
    • 4.19.0 before 4.22.1
    Source-reported fixed versions
    • 4.18.5
    • 4.22.1
    • 4.23.0
    Mitigation guidance
    • No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run.
    • Users are recommended to upgrade to version 4.23.0, which fixes the issue.
    • If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1.
    • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-88900] Arbitrary code execution via untrusted data deserialization

    CVE-2026-88900Source published Source updated

    Arbitrary code execution via untrusted data deserialization. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. Affected product named by the advisory: Red Hat Fuse 7.

    Related products — impact not confirmed
    • Red Hat Fuse 7
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features