Improper validation of integrity check value in Apache Camel - CVE-2026-85243
Published: October 23, 2026
Vulnerability identifier: #VU157297
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85243
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass message integrity verification and cause modified encrypted content to be accepted without detection.
The vulnerability exists due to improper validation of integrity check values in the Apache Camel Crypto PGP component's unmarshal() method when processing messages that use legacy OpenPGP symmetrically encrypted data packets without a modification detection code. A remote attacker can supply or rewrite a message using this attacker-selected packet type to bypass integrity verification and manipulate decrypted content through the malleability of OpenPGP's CFB mode.
Affected software
Apache Camel
How to mitigate CVE-2026-85243
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1