Apache Camel Security Advisory: CVE-2026-43865 Unsafe Java Deserialization RCE

Apache Camel Security Advisory: CVE-2026-43865 Vulnerability Overview Severity: Medium Summary: Camel-Hazelcast contains an insecure Java deserialization issue in Hazelcast instances with default configuration, which can lead to Remote Code Execution (RCE). Description: When Camel builds a Hazelcast cluster, if no user-provided Hazelcast instance, configuration, or Bean is supplied, Hazelcast's Java serialization filter configuration is ignored. This causes received objects to be processed by Camel after deserialization. Attackers can publish maliciously crafted serialized objects, thereby triggering Remote Code Execution in every Camel route. Affected Versions Affected Versions: - 4.0.0 to 4.14.8 - 4.15.0 to 4.18.3 - 4.19.0 to 4.21.0 Affected Components: - hazelcast-topic - hazelcast-queue - hazelcast-seda - hazelcast-map - hazelcast-multimap - hazelcast-replicatedmap - hazelcast-list - hazelcast-set - HazelcastAggregationRepository - HazelcastIdempotentRepository Remediation Fixed Versions: 4.14.8, 4.18.3, and 4.21.0 Mitigations: - Upgrade to version 4.21.0 or later. - For users unable to upgrade immediately, configure the deserialization filter as follows: - Use a user-provided or . - Set the JVM system property . - Enable Hazelcast cluster authentication and TLS to restrict access. References PGP Signed Advisory Data MITRE CVE Entry

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel Security Advisory: CVE-2026-43865 Unsafe Java Deserialization RCE