CVE-2024-22369
published 2024-02-20CVE-2024-22369: Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.75%
50.7th percentile
Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.
Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | — | — |
| apache | camel | — | — |
| apache | camel | — | — |
| apache | camel | >= 3.0.0 < 4.14.6 | 4.14.6 |
| apache | camel | >= 3.0.0 < 3.21.4 | 3.21.4 |
| apache | camel | >= 4.0.0 < 4.0.4 | 4.0.4 |
| apache | camel | >= 4.0.0 < 4.14.7 | 4.14.7 |
| apache | camel | >= 4.1.0 < 4.4.0 | 4.4.0 |
| apache | camel | >= 4.15.0 < 4.18.1 | 4.18.1 |
| apache | camel | >= 4.15.0 < 4.18.2 | 4.18.2 |
| apache_software_foundation | apache_camel | >= 4.0.0 < 4.14.7 | 4.14.7 |
| apache_software_foundation | apache_camel | >= 4.15.0 < 4.18.2 | 4.18.2 |
| apache_software_foundation | apache_camel | >= 4.19.0 < 4.20.0 | 4.20.0 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa7.8HIGH
vendor_apache7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data
ghsa·2026-04-27·CVSS 7.8
CVE-2026-40858 [HIGH] CWE-502 Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data
Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data
The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.
Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases
GHSA
Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
ghsa·2026-04-27·CVSS 7.8
CVE-2026-27172 [HIGH] CWE-502 Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-257
GHSA
Deserialization of Untrusted Data in Apache Camel SQL
ghsa·2024-02-20
CVE-2024-22369 [HIGH] CWE-502 Deserialization of Untrusted Data in Apache Camel SQL
Deserialization of Untrusted Data in Apache Camel SQL
Deserialization of Untrusted Data vulnerability in Apache Camel SQL Component. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.
Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
OSV
Deserialization of Untrusted Data in Apache Camel SQL
osv·2024-02-20
CVE-2024-22369 [HIGH] Deserialization of Untrusted Data in Apache Camel SQL
Deserialization of Untrusted Data in Apache Camel SQL
Deserialization of Untrusted Data vulnerability in Apache Camel SQL Component. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.
Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
Red Hat
Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
vendor_redhat·2024-02-19·CVSS 7.8
CVE-2024-22369 [HIGH] CWE-502 Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.
Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
A deserialization of untrusted data flaw was found in Apache Camel SQL Component JDBCAggregationRepository. The affected versions of Apache Camel are vulnerable to unsafe deserialization, where, under specific conditions, it is possible to deserialize a malicious payload.
Packa
Apache
Apache camel: CVE-2024-22369
vendor_apache·CVSS 7.8
CVE-2024-22369 [HIGH] Apache camel: CVE-2024-22369
Apache camel: CVE-2024-22369
From 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. 3.21.4, 3.22.1, 4.0.4 and 4.4.0 HIGH Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository 2023
Severity: high
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40858 org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data
bugzilla·2026-04-27·CVSS 7.8
CVE-2026-40858 [HIGH] CVE-2026-40858 org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data
CVE-2026-40858 org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data
The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application.
This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.
Users are recommended to upgrade to version 4.20.0,
Bugzilla
CVE-2026-27172 org.apache.camel/camel-consul: Apache Camel camel-consul: Arbitrary code execution via deserialization of untrusted data
bugzilla·2026-04-27·CVSS 7.8
CVE-2026-27172 [HIGH] CVE-2026-27172 org.apache.camel/camel-consul: Apache Camel camel-consul: Arbitrary code execution via deserialization of untrusted data
CVE-2026-27172 org.apache.camel/camel-consul: Apache Camel camel-consul: Arbitrary code execution via deserialization of untrusted data
The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel com
Bugzilla
CVE-2026-6857 camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization
bugzilla·2026-04-21·CVSS 7.8
CVE-2026-6857 [HIGH] CVE-2026-6857 camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization
CVE-2026-6857 camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization
Unsafe deserialization in camel-infinispan ProtoStream remote aggregation repository. DefaultExchangeHolderUtils.deserialize() uses ClassLoadingAwareObjectInputStream.readObject() without ObjectInputFilter. Same pattern as CVE-2024-22369, CVE-2024-23114, CVE-2026-25747.
Verified on Camel 4.10.0 + Infinispan 15.1.4. Reported to [email protected] and MITRE CVE Request #2024308.
2024-02-20
Published