PT-2026-20653 · Apache · Apache Camel

Andrea Cosentino · Published 2026-02-19 · Updated 2026-04-27 · CVE-2026-25747

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.10.0 through 4.10.7 Apache Camel versions 4.14.0 through 4.14.4 Apache Camel versions 4.15.0 through 4.17.9

Description The Apache Camel LevelDB component contains a flaw related to the deserialization of untrusted data. The DefaultLevelDBSerializer class deserializes data from the LevelDB aggregation repository using java.io.ObjectInputStream without implementing appropriate safeguards like ObjectInputFilter or class-loading restrictions. This allows an attacker who can write to the LevelDB database files used by a Camel application to inject a malicious serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitrary code execution within the application's context. The component LevelDB uses the function DefaultLevelDBSerializer to deserialize data. The vulnerable parameter is the serialized Java object written to the LevelDB database.

Recommendations Upgrade to Apache Camel version 4.18.0 or later. Upgrade to Apache Camel version 4.10.9 for the 4.10.x LTS releases. Upgrade to Apache Camel version 4.14.5 for the 4.14.x LTS releases.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-25747

GHSA-429Q-MRC4-38FR

Affected Products

Apache Camel

References · 20

• 🔥 https://github.com/oscerd/CVE-2026-25747 · Exploit
• https://camel.apache.org/security/CVE-2026-25747.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25747 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25747 · Security Note
• https://osv.dev/vulnerability/GHSA-429q-mrc4-38fr · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/0e3ac39e20416c91af6df2cfce3f7d795e75ad89 · Note
• https://github.com/apache/camel/commit/af2f2e9571b3b03a36b771bd9eb10427886d9636 · Note
• https://github.com/apache/camel/commit/5f343367f7b25646b7d12be26c3e87381c7a7ecb · Note
• https://t.me/CVEtracker/51923 · Telegram Post
• https://t.me/cveNotify/161045 · Telegram Post
• https://twitter.com/oss_security/status/2024306390156611623 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/18/6 · Note
• https://t.me/cveNotify/153325 · Telegram Post
• https://twitter.com/cracbot/status/2027338064138522826 · Twitter Post