Skip to content
OpenAdvisories

Package · Maven

org.apache.camel:camel-pqc

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.8
    CVE-2026-43867 Public exploit

    Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

    Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMeta…

    Apache Software Foundation Apache Camel org.apache.camel:camel-pqc Maven
  • High 8.8
    CVE-2026-46590 Public exploit

    Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

    Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsMana…

    Apache Software Foundation Apache Camel org.apache.camel:camel-pqc Maven
  • High 7.8
    CVE-2026-40048 Public exploit

    Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

    The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.…

    Apache Software Foundation Apache Camel PQC org.apache.camel:camel-pqc Maven