CVE-2026-43865

camel-hazelcast Default-Instance Unsafe Deserialization Reproducer CVE-2026-43865 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-hazelcast component, tracked as CVE-2026-43865. When Camel builds the Hazelcast Config itself — i.e. when no user-supplied...

CVE-2026-78162

CVE-2026-78162 — camel-hazelcast: managed instance without a Java deserialization filter Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-hazelcast created Hazelcast instances without aJavaSerializationFilterConfig on two configuration paths that the...

CLEANSTART-2026-AW65525 Hazelcast is a unified real-time data platform combining stream processing with a fast data store

CVE-2026-107726 affects multiple packages. Hazelcast is a unified real-time data platform combining stream processing with a fast data store. See references for individual vulnerability details...

CLEANSTART-2026-NN87055 Hazelcast is a unified real-time data platform combining stream processing with a fast data store

CVE-2026-107725 affects multiple packages. Hazelcast is a unified real-time data platform combining stream processing with a fast data store. See references for individual vulnerability details...

Apache Karaf Cellar 4.4.8 Remote Code Execution

Apache Karaf Cellar version 4.4.8 contains an unauthenticated cluster-join vulnerability that allows a network-adjacent attacker to publish a bundle event and execute code on cluster nodes. !/usr/bin/env bash Apache Karaf Cellar 4.4.8 Remote Code Execution Vendor: The Apache Software Foundation...

CLEANSTART-2026-VX52649 Hazelcast is a unified real-time data platform combining stream processing with a fast data store

CVE-2026-107725 affects multiple packages. Hazelcast is a unified real-time data platform combining stream processing with a fast data store. See references for individual vulnerability details...

CLEANSTART-2026-JE76711 Hazelcast is a unified real-time data platform combining stream processing with a fast data store

CVE-2026-107726 affects multiple packages. Hazelcast is a unified real-time data platform combining stream processing with a fast data store. See references for individual vulnerability details...

org.apache.camel.karaf:camel-hazelcast (>=4.7.0, <=4.18.4), org.apache.camel.karaf:camel-hazelcast-test (>=4.7.0, <=4.18.4) +6 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.0.0, <=4.18.4)

org.apache.camel:camel-hazelcast MAVEN version =4.0.0, =4.7.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 - org.apache.karaf.cellar.samples.camel.hazelcast:consumer 4.4.8 - org.apache.karaf.cellar.samples.camel.hazelcast:producer 4.4.8 Source cves: CVE-2026-78162 Source advisory:...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the Camel-built Hazelcast configurations in HazelcastDefaultComponentgetOrCreateHzClientInstance and ReplicatedHazelcastAggregationRepositorydoStart. An attacker who can publish to the attached...

org.apache.camel.quarkus:camel-quarkus-hazelcast (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-hazelcast-deployment (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.19.0, <=4.22.0)

org.apache.camel:camel-hazelcast MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78162 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430143...

CVE-2026-78162

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

CVE-2026-78162

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

org.apache.camel.quarkus:camel-quarkus-hazelcast (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-hazelcast-deployment (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.19.0, <=4.22.0)

org.apache.camel:camel-hazelcast MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78162 Source advisory: MEND:CVE-2026-78162...

CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

org.apache.camel.karaf:camel-hazelcast (>=4.18.1, <=4.18.4), org.apache.camel.karaf:camel-hazelcast-test (>=4.18.1, <=4.18.4) +4 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.15.0, <=4.18.4)

org.apache.camel:camel-hazelcast MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.4 Source cves: CVE-2026-78162 Source advisory: MEND:CVE-2026-78162...

CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

EUVD-2026-104224

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

CVE-2026-78162

Apache Camel's camel-hazelcast component (specifically camel-hazelcast-starter and camel-quarkus-hazelcast) is vulnerable to CWE-502 Deserialization of Untrusted Data. The root cause is an incomplete fix for CVE-2026-43865 where two configuration paths—ReplicatedHazelcastAggregationRepository#doS...

CVE-2026-78162: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

PT-2026-117327

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description The camel-hazelcast component fails to apply a JavaSerializationFilterConfig to Hazelcast instances created through specific configuration paths...