Deserialization of untrusted data in Apache Camel allows an attacker who can supply a serialized Java object to a Camel consumer to trigger DNS queries. The default ObjectInputFilter permits classes such as java.net.URL, which perform network I/O during hashCode or readObject. When a HashMap containing these classes is deserialized, the JVM contacts domain names supplied in the payload, leaking which hosts were queried to an attacker‑controlled DNS server. This results in a side‑channel that can disclose network information about the system and the attacker’s host, without executing arbitrary code. This vulnerability is a deserialization flaw (CWE‑502).

Apache Camel components shipped before specific patch versions are affected. The vulnerability exists in camel‑jms, camel‑sjms, camel‑amqp, camel‑mina, camel‑netty, camel‑netty‑http, camel‑vertx‑http, camel‑infinispan, camel‑sql, and the aggregation‑repository components camel‑leveldb, camel‑cassandraql, camel‑consul. The affected versions range from 4.14.0 to before 4.14.8, from 4.15.0 to before 4.18.3, and from 4.19.0 to before 4.21.0. The fixed releases are 4.14.8 for the 4.14.x line, 4.18.3 for the 4.18.x line, and 4.21.0 for the 4.21.x line.

Overall, the EPSS score is less than 1 %, indicating a very low current probability of exploitation that has been observed. The CVSS score of 8.1 categorizes this vulnerability as High severity, highlighting the potential for significant side‑channel information leakage. The vulnerability is not listed in the CISA KEV catalog, but it remains the ability to deliver a serialized payload to a running Camel consumer, a scenario that can arise in applications exposed over JMS, AMQP, or Netty. If the attacker can reach a Camel endpoint, the side‑channel can be used to learn which domain names the application resolves, potentially revealing internal network structure. While the exploitability is restricted to deserialization of untrusted data, the potential impact of information disclosure makes it important to address promptly.