CVE-2026-27172

camel-consul ConsulRegistry Deserialization Vulnerability Reproducer CVE-2026-27172 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-consul component ConsulRegistry, tracked as CVE-2026-27172. It is the same class of issue as CVE-2024-22369 , CVE-2024-23114 a...

org.apache.camel.karaf:camel-consul (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-consul-test (>=4.18.1, <=4.18.2) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.15.0, <=4.18.2)

org.apache.camel:camel-consul MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890719...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.19.0, <=4.20.0)

org.apache.camel:camel-consul MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890719...

org.apache.camel.karaf:camel-consul (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-consul-test (>=4.14.5, <=4.14.7) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.14.0, <=4.14.7)

org.apache.camel:camel-consul MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890719...

org.apache.camel.karaf:camel-consul (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-consul-test (>=4.14.5, <=4.14.7) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.14.0, <=4.14.7)

org.apache.camel:camel-consul MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-consul (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-consul-test (>=4.18.1, <=4.18.2) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.18.0, <=4.18.2)

org.apache.camel:camel-consul MAVEN version =4.18.0, =4.18.1, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-consul (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-consul-test (>=4.14.5, <=4.14.7) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.14.0, <=4.14.7)

org.apache.camel:camel-consul MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.19.0, <=4.20.0)

org.apache.camel:camel-consul MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.19.0, <=4.20.0)

org.apache.camel:camel-consul MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-consul (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-consul-test (>=4.18.1, <=4.18.2) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.18.0, <=4.18.2)

org.apache.camel:camel-consul MAVEN version =4.18.0, =4.18.1, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.karaf:camel-consul (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-consul-test (>=4.18.1, <=4.18.2) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.18.0, <=4.18.2)

org.apache.camel:camel-consul MAVEN version =4.18.0, =4.18.1, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.19.0, <=4.20.0)

org.apache.camel:camel-consul MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

org.apache.camel.karaf:camel-consul (>=4.14.5, <=4.14.7), org.apache.camel.karaf:camel-consul-test (>=4.14.5, <=4.14.7) +5 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-consul (>=4.14.0, <=4.14.7)

org.apache.camel:camel-consul MAVEN version =4.14.0, =4.14.5, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.29.0, <=3.33.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=4.15.0, <=4.18.0)

org.apache.camel:camel-consul MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.18.0 Source cves: CVE-2026-27172 Source advisory: OSV:GHSA-5RC6-9QFP-8VWG...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.29.0, <=3.33.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=4.15.0, <=4.18.0)

org.apache.camel:camel-consul MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.18.0 Source cves: CVE-2026-27172 Source advisory: GHSA-5RC6-9QFP-8VWG...

org.apache.camel.kafkaconnector:camel-consul-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.karaf:camel-consul (>=4.7.0, <=4.14.5) +7 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=3.0.0, <=4.14.5)

org.apache.camel:camel-consul MAVEN version =3.0.0, =0.1.0, =4.7.0, =4.8.1, =1.0.0-m3, =1.0.0-m3, =1.0.0-m3, =4.6.0, =3.0.0, =4.14.5 - org.wildfly.camel:wildfly-camel-itests-standalone-docker 12.0.0 Source cves: CVE-2026-27172 Source advisory: OSV:GHSA-5RC6-9QFP-8VWG...

Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.29.0, <=3.33.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=4.15.0, <=4.18.0)

org.apache.camel:camel-consul MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.18.0 Source cves: CVE-2026-27172 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321641...

org.apache.camel.kafkaconnector:camel-consul-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.karaf:camel-consul (>=4.7.0, <=4.14.5) +8 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=3.0.0-m1, <=4.14.5)

org.apache.camel:camel-consul MAVEN version =3.0.0-m1, =0.1.0, =4.7.0, =4.8.1, =1.0.0-m3, =1.0.0-m3, =1.0.0-m3, =4.6.0, =3.0.0, =3.0.0-m1, =3.0.0-rc3 - org.wildfly.camel:wildfly-camel-itests-standalone-docker 12.0.0 Source cves: CVE-2026-27172 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321641...