Description
Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a fresh copy, and returned that shared object as the exchange body. Because the instance is shared process-wide, state written while unmarshalling one message stayed on the object and was visible to every later message that used the same type. Fields absent from a later payload retained the previous message's values, so content belonging to one sender could be read while processing another sender's message, and concurrent exchanges could observe each other's partially written state. In a deployment that serves more than one tenant or user through the same route, that is disclosure of one party's data to another.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Unmarshalling now deserializes into a copy, so each exchange gets its own instance and no state carries between messages. For deployments that cannot upgrade immediately, copy the unmarshalled body into a new instance immediately after the data format runs, and do not retain references to the returned object.
Published: 2026-10-19
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Data Disclosure between Exchanges
Action: Apply Patch
AI Analysis

Impact

The Apache Camel Thrift component incorrectly shares a single default instance of the target type for all incoming messages. During unmarshalling, the data is written into this shared object, and the same instance is returned as the exchange body. As a result, fields that are not present in a newer payload retain values from a previous message, allowing data from one sender to be visible to another. This constitutes a confidentiality breach that can expose sensitive information between distinct message streams.

Affected Systems

Apache Camel is affected across multiple releases. Versions from the initial 4.0.0 up through 4.18.4, and from 4.19.0 up through 4.22.0, contain the flaw. The issue has been fixed in 4.18.5 for the 4.18.x LTS line, 4.22.1 for the 4.22.x LTS line, and fully in 4.23.0. Project users should verify which release line they run and plan an upgrade accordingly.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate impact, and no EPSS score is currently available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is sending crafted Thrift payloads to a Camel route that utilizes the failing deserialization logic; concurrent or successive messages may leak data between tenants or sessions. The risk level advises timely mitigation rather than passive monitoring.

Generated by OpenCVE AI on October 19, 2026 at 12:36 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Unmarshalling now deserializes into a copy, so each exchange gets its own instance and no state carries between messages.

Vendor Workaround

For deployments that cannot upgrade immediately, copy the unmarshalled body into a new instance immediately after the data format runs, and do not retain references to the returned object.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to 4.23.0 or to the matching patch version for the release line (4.18.5 for 4.18.x LTS, 4.22.1 for 4.22.x LTS).
  • If an immediate upgrade is infeasible, copy the unmarshalled body into a new instance immediately after the data format runs and avoid retaining references to the returned object.
  • Configure routes to isolate per‑tenant traffic or limit the Thrift component to single‑tenant deployments when using affected Camel versions.
  • Address the CWE‑488 weakness by ensuring each message deserializes into a fresh instance so no cross‑message data leakage occurs.

Generated by OpenCVE AI on October 19, 2026 at 12:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a fresh copy, and returned that shared object as the exchange body. Because the instance is shared process-wide, state written while unmarshalling one message stayed on the object and was visible to every later message that used the same type. Fields absent from a later payload retained the previous message's values, so content belonging to one sender could be read while processing another sender's message, and concurrent exchanges could observe each other's partially written state. In a deployment that serves more than one tenant or user through the same route, that is disclosure of one party's data to another. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Unmarshalling now deserializes into a copy, so each exchange gets its own instance and no state carries between messages. For deployments that cannot upgrade immediately, copy the unmarshalled body into a new instance immediately after the data format runs, and do not retain references to the returned object.
Title Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
Weaknesses CWE-488
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T10:32:44.450Z

Reserved: 2026-09-03T16:23:37.430Z

Link: CVE-2026-85245

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:22.527

Modified: 2026-10-19T11:17:22.527

Link: CVE-2026-85245

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:45:14Z

Weaknesses
  • CWE-488

    Exposure of Data Element to Wrong Session