org.apache.camel:camel-infinispan

3 results · Feed

• High 8.1
  CVE-2026-42527 Public exploit

  Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**'…

  Apache Software Foundation Apache Camel org.apache.camel:camel-jms org.apache.camel:camel-sjms Maven
  Jul 6, 2026
• High 8.8
  CVE-2026-40858 Public exploit

  Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

  The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache us…

  Apache Software Foundation Apache Camel org.apache.camel:camel-infinispan Maven
  Apr 27, 2026
• High 7.5
  CVE-2026-6857 Public exploit

  Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

  A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code ex…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8 Red Hat Fuse 7 Maven
  Apr 22, 2026