Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-88900— Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution

Quick assessment

Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Camel 的 Camel-Jgroups 组件存在“反序列化不可信数据”漏洞。 受影响版本范围： Apache Camel 4.0.0 至 4.18.4（含） Apache Camel 4.19.0 至 4.22.0（含） 漏洞详情： 方法由 在 JGroups 消费者接收到每条消息、且该消息尚未被路由前调用。该方法通过调用 将交换体（exchange body）设置为反序列化后的对象。对于 Camel JGroups 生产者发送的 类型消息，JGroups 会在其自身的接收线程中，使用 对消息负载

CVSS 8.8 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
Apache Software Foundation Apache Camel 4.0.0< 4.18.5 affected
4.19.0< 4.22.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88900

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Camel 4.0.0 ~ 4.18.5 -

II. Public POCs for CVE-2026-88900

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88900

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-88900 (7)

Vendor Advisories for CVE-2026-88900 (2)

Vendor Pages for CVE-2026-88900 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-19 · 62 CVEs total

CVE-2026-78162 10.0 CRITICAL Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom
CVE-2026-78165 8.8 HIGH Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
CVE-2026-83531 8.8 HIGH Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie
CVE-2026-78164 8.2 HIGH Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid
CVE-2026-80312 8.2 HIGH Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
CVE-2026-80343 8.2 HIGH Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path
CVE-2026-80344 8.2 HIGH Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro
CVE-2026-88901 8.2 HIGH Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by d
CVE-2026-85250 7.5 HIGH Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum
CVE-2026-85251 7.5 HIGH Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
CVE-2026-79986 7.4 HIGH Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re
CVE-2026-79983 7.4 HIGH Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i
CVE-2026-79985 7.4 HIGH Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i
CVE-2026-79984 7.4 HIGH Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name repo
CVE-2026-85254 6.5 MEDIUM Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name
CVE-2026-84176 6.5 MEDIUM Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig
CVE-2026-85314 6.5 MEDIUM Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMult
CVE-2026-85296 6.5 MEDIUM Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
CVE-2026-91858 6.5 MEDIUM Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh
CVE-2026-85249 6.5 MEDIUM Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata

Showing top 20 of 62 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Apache Camel
Same vendor: Apache Software Foundation
Same weakness: CWE-502

V. Comments for CVE-2026-88900

No comments yet

Leave a comment