CVE-2026-78162

Apache Camel's camel-hazelcast component (specifically camel-hazelcast-starter and camel-quarkus-hazelcast) is vulnerable to CWE-502 Deserialization of Untrusted Data. The root cause is an incomplete fix for CVE-2026-43865 where two configuration paths—ReplicatedHazelcastAggregationRepository#doS...

EUVD-2026-104224

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

PT-2026-117327

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

CVE-2026-43865

camel-hazelcast Default-Instance Unsafe Deserialization Reproducer CVE-2026-43865 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-hazelcast component, tracked as CVE-2026-43865. When Camel builds the Hazelcast Config itself — i.e. when no user-supplied...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the managed Hazelcast instance creation paths in HazelcastDefaultComponentgetOrCreateHzInstance, HazelcastUtilnewInstance, HazelcastAggregationRepositorydoStart, and...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865

Apache Camel's camel-hazelcast component is vulnerable to remote code execution (RCE) due to insecure deserialization of untrusted data. When Camel creates a Hazelcast instance using its default configuration (i.e., no user-supplied instance, URI, or bean), it fails to apply a Java deserializatio...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

PT-2026-55884

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a...