Apache Camel LevelDB Java DefaultLevelDBSerializer Code Execution

The vulnerability of the Camel-LevelDB DefaultLevelDBSerializer class in the Apache Camel LevelDB Java framework is related to deserialization mechanism flaws. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

org.apache.camel.karaf:camel-leveldb (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-leveldb-test (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.15.0, <=4.18.2)

org.apache.camel:camel-leveldb MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890717...

org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.19.0, <=4.20.0)

org.apache.camel:camel-leveldb MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890717...

org.apache.camel.karaf:camel-leveldb (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-leveldb-test (>=4.14.5, <=4.14.7) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.14.0, <=4.14.7)

org.apache.camel:camel-leveldb MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890717...

org.apache.camel.karaf:camel-leveldb (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-leveldb-test (>=4.14.5, <=4.14.7) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.14.0, <=4.14.7)

org.apache.camel:camel-leveldb MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.19.0, <=4.20.0)

org.apache.camel:camel-leveldb MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-leveldb (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-leveldb-test (>=4.14.5, <=4.14.7) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.14.0, <=4.14.7)

org.apache.camel:camel-leveldb MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-leveldb (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-leveldb-test (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.18.0, <=4.18.2)

org.apache.camel:camel-leveldb MAVEN version =4.18.0, =4.18.1, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.19.0, <=4.20.0)

org.apache.camel:camel-leveldb MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-leveldb (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-leveldb-test (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.18.0, <=4.18.2)

org.apache.camel:camel-leveldb MAVEN version =4.18.0, =4.18.1, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.19.0, <=4.20.0)

org.apache.camel:camel-leveldb MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

org.apache.camel.karaf:camel-leveldb (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-leveldb-test (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.18.0, <=4.18.2)

org.apache.camel:camel-leveldb MAVEN version =4.18.0, =4.18.1, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

org.apache.camel.karaf:camel-leveldb (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-leveldb-test (>=4.14.5, <=4.14.7) +4 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-leveldb (>=4.14.0, <=4.14.7)

org.apache.camel:camel-leveldb MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

Apache Camel Deserializes Untrusted Data in its LevelDB Component

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.29.0, <=3.31.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.29.0, <=3.31.0) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.15.0, <=4.17.0)

org.apache.camel:camel-leveldb MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.17.0 Source cves: CVE-2026-25747 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-15353482...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the DefaultLevelDBSerializer class. An attacker can execute arbitrary code by injecting a crafted serialized Java object into the LevelDB database files, which is then deserialized during normal...

GHSA-429Q-MRC4-38FR Apache Camel Deserializes Untrusted Data in its LevelDB Component

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

org.apache.camel.karaf:camel-leveldb (>=4.7.0, <=4.10.7), org.apache.camel.karaf:camel-leveldb-test (>=4.8.1, <=4.10.7) +4 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=3.0.0, <=4.10.8)

org.apache.camel:camel-leveldb MAVEN version =3.0.0, =4.7.0, =4.8.1, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =4.10.8 Source cves: CVE-2026-25747 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-15353482...

org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.22.0, <=3.27.2), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.22.0, <=3.27.2) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.11.0, <=4.14.4)

org.apache.camel:camel-leveldb MAVEN version =4.11.0, =3.22.0, =3.22.0, =3.22.0, =4.11.0, =4.14.4 Source cves: CVE-2026-25747 Source advisory: OSV:GHSA-429Q-MRC4-38FR...