Skip to content
fr Sign in
Not rated

CVE-2026-40858 The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote…

Description

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2. The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23322 refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

Affected products and versions

Product Affected versions Fixed in
Apache Camel 4.19 4.19.0 → < 4.20.0 4.20.0
Apache Camel 4.15 4.15.0 → < 4.18.2 4.18.2
Apache Camel 4.0 4.0.0 → < 4.14.7 4.14.7
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 Versions not published
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Camel

The 97 CVEs of Apache Camel →
CVE-2026-71569 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component 4.8 Medium CVE-2026-90885 Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component 7.5 High CVE-2026-94386 Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component 4.8 Medium CVE-2026-95628 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling… 5.4 Medium
Track this CVE