CVE-2026-40858

camel-infinispan Remote Aggregation Repository Unsafe Deserialization Reproducer CVE-2026-40858 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-infinispan component, tracked as CVE-2026-40858. The ProtoStream-based remote aggregation repository serializes ea...

org.apache.camel.quarkus:camel-quarkus-infinispan (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-infinispan-cluster-service (>=3.35.0, <=3.36.0) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.19.0, <=4.20.0)

org.apache.camel:camel-infinispan MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890716...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (>=4.14.0, <=4.14.5) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.14.0, <=4.14.7)

org.apache.camel:camel-infinispan MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890716...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (4.18.0) +11 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.15.0, <=4.18.2)

org.apache.camel:camel-infinispan MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.32.0, =3.32.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.32.0, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17890716ht...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (4.18.0) +11 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.18.0, <=4.18.2)

org.apache.camel:camel-infinispan MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCRhttps://vuln...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (>=4.14.0, <=4.14.5) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.14.0, <=4.14.7)

org.apache.camel:camel-infinispan MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (4.18.0) +11 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.18.0, <=4.18.2)

org.apache.camel:camel-infinispan MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCRhttps://vulners...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (>=4.14.0, <=4.14.5) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.14.0, <=4.14.7)

org.apache.camel:camel-infinispan MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-infinispan (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-infinispan-cluster-service (>=3.35.0, <=3.36.0) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.19.0, <=4.20.0)

org.apache.camel:camel-infinispan MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

org.apache.camel.quarkus:camel-quarkus-infinispan (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-infinispan-cluster-service (>=3.35.0, <=3.36.0) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.19.0, <=4.20.0)

org.apache.camel:camel-infinispan MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: GHSA-8H6P-JVHF-9HCR...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (4.18.0) +11 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.18.0, <=4.18.2)

org.apache.camel:camel-infinispan MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.0, =4.18.2 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527https://vulners...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (>=4.14.0, <=4.14.5) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.14.0, <=4.14.7)

org.apache.camel:camel-infinispan MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =4.14.7 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

org.apache.camel.quarkus:camel-quarkus-infinispan (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-infinispan-cluster-service (>=3.35.0, <=3.36.0) +8 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-infinispan (>=4.19.0, <=4.20.0)

org.apache.camel:camel-infinispan MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: MEND:CVE-2026-42527...

org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data

A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitra...

camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to...

org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data

A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitra...

camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to...

CVE-2026-40858

A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitra...

org.apache.camel.springboot:camel-infinispan-cluster-service-starter (4.19.0), org.apache.camel.springboot:camel-infinispan-starter (4.19.0) potentially affected by CVE-2026-40858 via org.apache.camel:camel-infinispan (4.19.0)

org.apache.camel:camel-infinispan MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.springboot:camel-infinispan-cluster-service-starter 4.19.0 -...