CVE-2026-25747

LevelDB Deserialization Vulnerability Reproducer This project demonstrates a Java deserialization vulnerability in Apache Camel's LevelDB Aggregation Repository, similar to CVE-2024-23114 which affected the Cassandra Aggregation Repository. Vulnerability Summary Property| Value ---|--- Component|...

org.apache.camel.karaf:camel-leveldb (>=4.7.0, <=4.10.7), org.apache.camel.karaf:camel-leveldb-test (>=4.8.1, <=4.10.7) +4 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=3.0.0, <=4.10.8)

org.apache.camel:camel-leveldb MAVEN version =3.0.0, =4.7.0, =4.8.1, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =4.10.8 Source cves: CVE-2026-25747 Source advisory: OSV:GHSA-429Q-MRC4-38FR...

org.apache.camel.karaf:camel-leveldb (>=4.7.0, <=4.10.7), org.apache.camel.karaf:camel-leveldb-test (>=4.8.1, <=4.10.7) +4 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=3.0.0, <=4.10.8)

org.apache.camel:camel-leveldb MAVEN version =3.0.0, =4.7.0, =4.8.1, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =4.10.8 Source cves: CVE-2026-25747 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-15353482...

org.apache.camel.karaf:camel-leveldb (>=4.7.0, <=4.10.7), org.apache.camel.karaf:camel-leveldb-test (>=4.8.1, <=4.10.7) +4 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=3.0.0, <=4.10.8)

org.apache.camel:camel-leveldb MAVEN version =3.0.0, =4.7.0, =4.8.1, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =4.10.8 Source cves: CVE-2026-25747 Source advisory: GHSA-429Q-MRC4-38FR...

org.apache.camel.karaf:camel-leveldb (>=4.7.0, <=4.10.7), org.apache.camel.karaf:camel-leveldb-test (>=4.8.1, <=4.10.7) +4 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=3.0.0, <=4.10.8)

org.apache.camel:camel-leveldb MAVEN version =3.0.0, =4.7.0, =4.8.1, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =4.10.8 Source cves: CVE-2026-25747 Source advisory: MEND:CVE-2026-25747...

CVE-2026-25747 Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...