Description
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.



This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.



RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* ; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate. As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.
Published: 2026-10-19
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via unfiltered Java deserialization
Action: Patch Now
AI Analysis

Impact

The issue is an unfiltered Java deserialization flaw in the Camel‑Spring‑Redis component. When the component receives data from Redis, it uses a default JdkSerializationRedisSerializer that calls java.io.ObjectInputStream without a filter. An attacker can publish a crafted binary payload to a channel that Camel consumes or store malicious bytes in a key that Camel reads. Deserialization of that payload triggers the object's readObject method, allowing arbitrary code execution, data tampering, or data exfiltration. This flaw is classified as CWE‑502, which indicates a serious risk when untrusted data is deserialized without validation.

Affected Systems

Affected releases are Apache Camel 2.11.0 through 4.18.4, and 4.19.0 through 4.22.0. The short‑term fixes apply to 4.18.5, 4.22.1, and 4.23.0 and later. Deployments on older 4.14.x lines or earlier are out of support; they must migrate to a supported version. The vulnerability resides in the Camel‑Spring‑Redis component and its internal RedisTemplate usage on consumption, production, and the idempotent repository.

Risk and Exploitability

The CVSS base score is 8.8, indicating high severity, but EPSS is not provided, so we cannot judge current exploit frequency. The flaw is not listed in CISA KEV. Attackers need to control a Redis instance or publish to an exposed channel; the attack involves sending a malicious serialized object to the consumer side. Although the bug is not in the network stack, full access to the Redis data stream gives the attacker enough leverage to execute arbitrary code on the host running Camel.

Generated by OpenCVE AI on October 19, 2026 at 11:23 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x releases stream should upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. A new deserializationFilter endpoint option controls the filter applied while the default serializer reads Redis payloads; when it is not set, the JVM-wide jdk.serialFilter is honoured if present, and otherwise a conservative default allow-list is applied that permits standard Java and Apache Camel types and denies java.net. On 4.23.0 and 4.22.1 the default additionally enforces the JEP-290 graph-shape limits maxdepth, maxrefs and maxbytes; on 4.18.5 the equivalent local constant is applied without those limits. Because JdkSerializationRedisSerializer exposes no hook for installing a filter, the serializer is constructed through its Converter-based constructor with a deserializing converter that sets the filter on the stream before the graph is read. The single change covers the consumer, the producer read commands and SpringRedisIdempotentRepository.

Vendor Workaround

Set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* ; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate, because the consumer reads getSerializer directly. As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to 4.23.0 (or to 4.22.1 if on the 4.22.x stream, or to 4.18.5 if on the 4.18.x stream).
  • Configure the JVM‑wide jdk.serialFilter property to restrict deserialized types (e.g., -Djdk.serialFilter=!java.net.*;!java.*;!javax.*;!org.apache.camel.*;!*) or set the serializer endpoint option to a non‑Java serializer such as StringRedisSerializer.
  • Secure the Redis deployment with authentication, limit clients that can publish to subscribed channels, and isolate the instance from untrusted networks.

Generated by OpenCVE AI on October 19, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* ; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate. As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.
Title Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T10:08:17.232Z

Reserved: 2026-08-23T12:53:32.309Z

Link: CVE-2026-78165

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:19.643

Modified: 2026-10-19T11:17:19.643

Link: CVE-2026-78165

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T11:30:16Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data