CVE-2026-43867

camel-pqc AWS Secrets Manager Key-Metadata असुरक्षित डिसीरियलाइज़ेशन पुनरुत्पादक CVE-2026-43867 यह प्रोजेक्ट Apache Camel के camel-pqc घटक में एक जावा डिसीरियलाइज़ेशन भेद्यता प्रदर्शित करता है, जिसे CVE-2026-43867 के रूप में ट्रैक किया गया है।...

CVE-2026-46590

CVE-2026-46590 — camel-pqc Key-Lifecycle Unsafe Deserialization Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2026-40048

camel-pqc مُعيد إنتاج إلغاء التسلسل غير الآمن لـ FileBasedKeyLifecycleManager CVE-2026-40048 يُظهر هذا المشروع ثغرة إلغاء تسلسل Java في مكون camel-pqc في Apache Camel، المُتتبعة تحت CVE-2026-40048. يقوم FileBasedKeyLifecycleManager بقراءة ملفات .key من دليل المفاتيح المُهيأ باستخدام...

Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

The vulnerability of the camel-pqc component in the Apache Camel Java framework allows a attacker to execute arbitrary code.

The vulnerability of the camel-pqc component in the Apache Camel Java framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

CVE-2026-43867

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads that metadata back from the...

CVE-2026-43867 Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads that metadata back from the...

CVE-2026-46590

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

CVE-2026-46590 Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

GHSA-V3VG-332R-MW99 Camel-PQC Vulnerable to Deserialization of Untrusted Data

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

Camel-PQC Vulnerable to Deserialization of Untrusted Data

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

CVE-2026-40048

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

PT-2026-35369

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1 Description The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using...