PT-2026-35369 · Apache · Apache Camel
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Camel versions 4.19.0 through 4.19.x
Apache Camel versions 4.18.0 through 4.18.1
Description
The
FileBasedKeyLifecycleManager class in Camel-PQC performs insecure deserialization of untrusted data. It deserializes the contents of <keyId>.key files in the configured key directory using java.io.ObjectInputStream without applying an ObjectInputFilter or class-loading restrictions. Because the cast to java.security.KeyPair occurs only after the readObject() function has returned, any side effects within the deserialized object are executed before the type check. An attacker capable of writing to the key directory—via path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—can place a crafted serialized Java object to achieve arbitrary code execution within the application context.Recommendations
Upgrade to version 4.20.0.
Upgrade to version 4.18.2.
Exploit
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Camel