Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the DefaultLevelDBSerializer class. An attacker can execute arbitrary code by injecting a crafted serialized Java object into the LevelDB database files, which is then deserialized during normal...

org.apache.camel.karaf:camel-leveldb (>=4.10.3 <=4.10.7), org.apache.camel.karaf:camel-leveldb-test (>=4.10.3 <=4.10.7) +4 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=3.0.0 <=4.10.8)

org.apache.camel:camel-leveldb MAVEN version =3.0.0, =4.10.3, =4.10.3, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =4.10.8 Source cves: CVE-2026-25747 Source advisory: OSV:GHSA-429Q-MRC4-38FR...

GHSA-429Q-MRC4-38FR Apache Camel Deserializes Untrusted Data in its LevelDB Component

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

Apache Camel Deserializes Untrusted Data in its LevelDB Component

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

CVE-2026-25747

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

CVE-2026-25747

CVE-2026-25747 describes a Deserialization of Untrusted Data vulnerability in the Apache Camel LevelDB component. The issue stems from the DefaultLevelDBSerializer using java.io.ObjectInputStream to read from the LevelDB aggregation repository without ObjectInputFilter or class-loading restrictio...