CVE-2026-40048

camel-pqc FileBasedKeyLifecycleManager Unsafe Deserialization Reproducer CVE-2026-40048 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-pqc component, tracked as CVE-2026-40048. FileBasedKeyLifecycleManager reads .key files from the configured key directory...

CVE-2026-43867

camel-pqc AWS Secrets Manager Key-Metadata Unsafe Deserialization Reproducer CVE-2026-43867 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-pqc component, tracked as CVE-2026-43867. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads persisted...

Exploit for CVE-2026-85300

CVE-2026-85300 — camel-pqc: private key written with permissiv...

CVE-2026-46590

CVE-2026-46590 — camel-pqc Key-Lifecycle Unsafe Deserialization Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-pqc 4.18.2 Camel Quarkus|...

CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signature verification bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the PQC producer held a singlejava.security.Signature instance and used it for every exchange without synchronization. Signature is...

Exploit for CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signa...

Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

camel-pqc Apache Camel Component Code Execution

The vulnerability of the camel-pqc component in the Apache Camel Java framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-pqc Key-Lifecycle Unsafe Deserialization Reproducer CVE...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-pqc AWS Secrets Manager Key-Metadata Unsafe Deserializat...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-pqc FileBasedKeyLifecycleManager Unsafe Deserialization...

org.apache.camel.karaf:camel-pqc (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.32.0, <=3.33.1) +2 more potentially affected by CVE-2026-43867 via org.apache.camel:camel-pqc (>=4.18.0, <=4.18.2)

org.apache.camel:camel-pqc MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-43867 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17874245...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43867 via org.apache.camel:camel-pqc (>=4.19.0, <=4.20.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43867 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17874245...

org.apache.camel.karaf:camel-pqc (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.32.0, <=3.33.1) +2 more potentially affected by CVE-2026-46590 via org.apache.camel:camel-pqc (>=4.18.0, <=4.18.2)

org.apache.camel:camel-pqc MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46590 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17891732...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46590 via org.apache.camel:camel-pqc (>=4.19.0, <=4.20.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46590 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17891732...

GHSA-857V-XVH8-7HJC Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

org.apache.camel.karaf:camel-pqc (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.32.0, <=3.33.1) +2 more potentially affected by CVE-2026-46590 via org.apache.camel:camel-pqc (>=4.18.0, <=4.18.2)

org.apache.camel:camel-pqc MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46590 Source advisory: GHSA-857V-XVH8-7HJC...

Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46590 via org.apache.camel:camel-pqc (>=4.19.0, <=4.20.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46590 Source advisory: OSV:GHSA-857V-XVH8-7HJC...

org.apache.camel.karaf:camel-pqc (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.32.0, <=3.33.1) +2 more potentially affected by CVE-2026-46590 via org.apache.camel:camel-pqc (>=4.18.0, <=4.18.2)

org.apache.camel:camel-pqc MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46590 Source advisory: OSV:GHSA-857V-XVH8-7HJC...