Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

GHSA-857V-XVH8-7HJC Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...