CVE-2026-85245

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-85245 Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

EUVD-2026-104186

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-85245

The Apache Camel camel-thrift component is vulnerable to a cross-exchange data disclosure (CWE-488) because the ThriftDataFormat.unmarshal function uses a shared process-wide defaultInstance for deserialization. When unmarshalling, state from a previous message persists in the shared object if su...

PT-2026-117346

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...