Deserialization of Untrusted Data in Apache Camel - CVE-2026-78165
Published: October 23, 2026
Vulnerability identifier: #VU157284
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78165
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code in the Apache Camel application.
The vulnerability exists due to deserialization of untrusted data without an object input filter in the Apache Camel Spring Redis component when reading Redis payloads using its default Java serializer. A remote user can publish crafted serialized objects to a subscribed Redis channel or place them in Redis data subsequently read by the component to execute arbitrary code during deserialization.
Affected software
Apache Camel
How to mitigate CVE-2026-78165
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1, 4.23.0