https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:36:05.651653+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09300 bdu:2026-09300 2026-10-03T15:36:05.713627+00:00 bdu:2026-09300 https://cve.radiocsirt.org/vuln/euvd-2026-337429 EUVD-2026-337429 2026-10-03T15:36:05.713665+00:00 EUVD-2026-337429 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27172 fkie_cve-2026-27172 2026-10-03T15:36:05.713679+00:00

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.

Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

 https://cve.radiocsirt.org/vuln/ghsa-5rc6-9qfp-8vwg GHSA-5rc6-9qfp-8vwg — Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data 2026-10-03T15:36:05.713718+00:00

Affected: Maven: org.apache.camel:camel-consul

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.

Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0129 NCSC-2026-0129 — Kwetsbaarheden verholpen in Apache Camel 2026-10-03T15:36:05.713750+00:00 NCSC-2026-0129 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1271 WID-SEC-W-2026-1271 — Apache Camel: Mehrere Schwachstellen 2026-10-03T15:36:05.713773+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.