Description
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.
Published: 2026-10-19
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

Apache Camel’s JGroups consumer deserializes any object received via JGroups without applying a Java ObjectInputFilter, allowing an attacker to send a crafted serialized payload that will be instantiated and executed during deserialization. Because the deserialization occurs before Camel’s own processing, the broker cannot reject malicious objects, resulting in potential remote code execution. This flaw is a classic Java deserialization vulnerability (CWE‑502) and carries a CVSS score of 8.8.

Affected Systems

The issue affects Apache Camel releases from 4.0.0 up to but not including 4.18.5, and from 4.19.0 up to but not including 4.22.1. Older stream releases such as 4.14.x, 4.15.x‑17.x, and 4.19.x‑21.x are also impacted but have reached end‑of‑life and will not receive a fix.

Risk and Exploitability

The vulnerability can be exploited by any host that can reach the JGroups cluster’s multicast group or port, which in the default UDP configuration means a host on an adjacent network. If a gadget chain is present in the application’s classpath, an attacker can trigger remote code execution. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog, but the high CVSS score and openness of the multicast transport make this a serious threat, especially for deployments that expose the cluster to untrusted networks. Upgrading to 4.23.0 (or the equivalent patch levels 4.22.1 or 4.18.5) and configuring a JVM‑wide serialization filter or authenticating and encrypting the JGroups channel provide effective defense.

Generated by OpenCVE AI on October 19, 2026 at 12:22 UTC.

Remediation

Vendor Solution

Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The fixed releases check the class of the deserialized body against the deserializationFilter option before the exchange is routed; when the option is not set, the JVM-wide jdk.serialFilter is honoured if present, and otherwise the default allow-list !java.net.**;java.**;javax.**;org.apache.camel.**;!* is applied. Because this check runs after JGroups has deserialized the payload, it is defense in depth, and deployments on 4.22.1 and 4.18.5 must also configure at least one control that applies before the payload is read: a JVM-wide jdk.serialFilter that allows only the classes the routes exchange over the cluster, or a channel secured with AUTH together with SYM_ENCRYPT or ASYM_ENCRYPT through the channelProperties option. On 4.23.0, which ships JGroups 5.5.7.Final and so also honours the jgroups.deserialization.filter system property, the consumer refuses to start until at least one of these controls is configured, unless acceptAllObjects=true, an insecure serialization setting that restores the previous behaviour, is set. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.

Vendor Workaround

For deployments that cannot upgrade immediately, set a JVM-wide serialization filter with the jdk.serialFilter system property on the JVM that runs the jgroups consumer, allowing only the classes the routes exchange over the cluster, which applies because JGroups reads the payload through a java.io.ObjectInputStream; secure the channel by supplying, through the channelProperties option, a protocol stack that adds the AUTH protocol together with SYM_ENCRYPT or ASYM_ENCRYPT; and do not expose the cluster's multicast group or bind port to untrusted networks.

OpenCVE Recommended Actions

  • Upgrade to Apache Camel 4.23.0 (or to 4.22.1 if on the 4.22.x stream, or to 4.18.5 if on the 4.18.x stream) and migrate any unsupported release lines to a supported version
  • If an upgrade cannot be performed immediately, set a JVM‑wide serialization filter via the jdk.serialFilter system property to allow only the classes required by the Camel routes before the consumer starts
  • Configure the JGroups channel with authentication and encryption (AUTH with SYM_ENCRYPT or ASYM_ENCRYPT) through the channelProperties option, and restrict the multicast group or bind port so that only trusted hosts can join the cluster

Generated by OpenCVE AI on October 19, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.
Title Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T14:29:06.421Z

Reserved: 2026-09-10T11:43:06.921Z

Link: CVE-2026-88900

cve-icon Vulnrichment

Updated: 2026-10-19T14:28:55.533Z

cve-icon NVD

Status : Received

Published: 2026-10-19T12:17:11.980

Modified: 2026-10-19T15:17:08.910

Link: CVE-2026-88900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:30:14Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data