PT-2026-34329 · Unknown · Camel-Infinispan

Published 2026-04-22 · Updated 2026-05-21 · CVE-2026-6857

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions camel-infinispan (affected versions not specified)

Description Unsafe deserialization exists in the ProtoStream remote aggregation repository. A remote attacker with low privileges can send specially crafted data to achieve arbitrary code execution, potentially gaining full control over the affected system and impacting its confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-6857

GHSA-XFXP-PPX7-CQRP

Affected Products

Camel-Infinispan

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-6857 · Security Note
• https://access.redhat.com/errata/RHSA-2026:22453 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:17668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xfxp-ppx7-cqrp · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/ec297f89065b6cfc2682487a96411692d6c296e2 · Note
• https://t.me/cveNotify/164403 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2026-6857 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2460003 · Note
• https://twitter.com/CVEnew/status/2047012148573073639 · Twitter Post