Most recent entries from all

EUVD-2026-333484

2026-10-04T04:16:26.761263+00:00

EUVD-2026-333484

fkie_cve-2026-40859

2026-10-04T04:16:26.761300+00:00

Deserialization of Untrusted Data vulnerability in Apache Camel.

The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a man-in-the-middle position on an unencrypted (plain HTTP) connection, or by compromising the backend service - can return a crafted serialized Java object and, if a suitable gadget chain is present on the classpath, achieve remote code execution on the Camel application host. The path is not reachable in the default configuration, where transferException is false. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then t…

GHSA-6qw3-4796-5984 — Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInput…

2026-10-04T04:16:26.761351+00:00

Affected: Maven: org.apache.camel:camel-vertx-http, Maven: org.apache.camel:camel-netty-http

Deserialization of Untrusted Data vulnerability in Apache Camel.

RHSA-2026:54622 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.

2026-10-04T04:16:26.761398+00:00

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers org.apache.camel/camel-cxf: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass jackson-databind: Jackson-databind: Security bypass allow…

WID-SEC-W-2026-2203 — Apache Camel: Mehrere Schwachstellen

2026-10-04T04:16:26.761464+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.