Description
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | camel-infinispan | 4.0.0 – < 4.14.7, 4.15.0 – < 4.18.2, 4.19.0 – < 4.20.0 | 4.14.7 |
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 | — | — |
| Red Hat | Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
HORKimhab/CVE-2026-6857 ★ 0 · May 16, 2026
CVE-2026-6857
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.camel:camel-infinispan | < 4.20.0 | 4.20.0 | GHSA-xfxp-ppx7-cqrp |
References
- RHSA-2026:17668 vendor-advisory
- RHSA-2026:22453 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-6857 vdb-entry
- RHBZ#2460003 issue-tracking