CVE-2026-78165

The Apache Camel camel-spring-redis component (specifically camel-spring-redis-starter and camel-quarkus-spring-redis) is vulnerable to unfiltered Java deserialization (CWE-502). When no serializer option is configured, the component lazily builds a JdkSerializationRedisSerializer that lacks a ja...

CVE-2026-78165 Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

CVE-2026-78165 Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

PT-2026-117330

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...