CVE-2026-85248— Apache Camel 签名验证绕过漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Camel
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Camel PQC 组件中存在“共享资源并发执行且同步不当”（竞态条件）漏洞。 该问题影响 Apache Camel 的以下版本范围： 从 4.12.0 到 4.18.5（不含 4.18.5） 从 4.19.0 到 4.22.1（不含 4.22.1） 在受影响版本中，生产者持有一个单一的 实例，并在未进行同步控制的情况下，将其用于所有消息交换。 对象是状态化的且非线程安全：其 方法会累积待签名或验证的数据，而 方法则会消耗该累积状态。当多个并发消息交换共享同一个实例时，不同消息的 和 调用会发生交错，
可能的 ATT&CK 技术 1 AI
T1203 · Exploitation for Client Execution影响版本矩阵 5
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.12.0< 4.18.5 |
affected |
4.19.0< 4.22.1 |
affected | ||
4.18.5 |
unaffected | ||
4.22.1 |
unaffected | ||
4.23.0 |
unaffected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-85248 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
来源: CVE Program / CVE List V5
Vulnerability Description
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.
This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.
The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.12.0 ~ 4.18.5 | - |
|
二、漏洞 CVE-2026-85248 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-85248 的情报信息
请登录查看更多情报信息。
CVE-2026-85248 补丁与修复 (3)
CVE-2026-85248 厂商安全公告 (1)
-
🔗 Apache Camel Security Advisory - CVE-2026-85248 - Apache Camel vendor-advisory
CVE-2026-85248 其他参考 (1)
同批安全公告 · Apache Software Foundation · 2026-10-19 · 共 62 条
| CVE-2026-78162 | 10.0 CRITICAL | Apache Camel 反序列化过滤缺失漏洞 |
| CVE-2026-88900 | 8.8 HIGH | Apache Camel 反序列化漏洞 |
| CVE-2026-83531 | 8.8 HIGH | Apache Camel 动态路由控制端点远程代码执行漏洞 |
| CVE-2026-78165 | 8.8 HIGH | Apache Camel 反序列化漏洞 |
| CVE-2026-80312 | 8.2 HIGH | Apache Camel OAuth 身份验证绕过漏洞 |
| CVE-2026-80344 | 8.2 HIGH | Apache Camel 服务端请求伪造及凭证泄露漏洞 |
| CVE-2026-80343 | 8.2 HIGH | Apache Camel Netty-HTTP 路径匹配绕过漏洞 |
| CVE-2026-78164 | 8.2 HIGH | Apache Camel HTTP 生产者远程代码执行漏洞 |
| CVE-2026-88901 | 8.2 HIGH | Apache Camel 默认解析外部实体漏洞 |
| CVE-2026-85251 | 7.5 HIGH | Apache Camel HTTP 凭据泄露漏洞 |
| CVE-2026-85250 | 7.5 HIGH | Apache Camel XPath XML外部实体及文件泄露漏洞 |
| CVE-2026-79984 | 7.4 HIGH | Apache Camel 远程代码执行漏洞 |
| CVE-2026-79985 | 7.4 HIGH | Apache Camel 远程文件读取漏洞 |
| CVE-2026-79986 | 7.4 HIGH | Apache Camel 远程文件读取漏洞 |
| CVE-2026-79983 | 7.4 HIGH | Apache Camel 远程文件读取漏洞 |
| CVE-2026-91858 | 6.5 MEDIUM | Apache Camel Camel-FOP 远程代码执行漏洞 |
| CVE-2026-84176 | 6.5 MEDIUM | Apache Camel 跨域凭证暴露漏洞 |
| CVE-2026-85249 | 6.5 MEDIUM | Apache Camel 未过滤元数据导致头部注入漏洞 |
| CVE-2026-85314 | 6.5 MEDIUM | Apache Camel 邮件头注入漏洞 |
| CVE-2026-85296 | 6.5 MEDIUM | Apache Camel AS2 组件密钥混淆漏洞 |
显示前 20 条，共 62 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-85248
暂无评论