CVE-2026-43865

camel-hazelcast Default-Instance Unsafe Deserialization Reproducer CVE-2026-43865 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-hazelcast component, tracked as CVE-2026-43865. When Camel builds the Hazelcast Config itself — i.e. when no user-supplied...

CVE-2026-78162

CVE-2026-78162 — camel-hazelcast: managed instance without a Java deserialization filter Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-hazelcast created Hazelcast instances without aJavaSerializationFilterConfig on two configuration paths that the...

org.apache.camel.karaf:camel-hazelcast (>=4.7.0, <=4.18.4), org.apache.camel.karaf:camel-hazelcast-test (>=4.7.0, <=4.18.4) +6 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.0.0, <=4.18.4)

org.apache.camel:camel-hazelcast MAVEN version =4.0.0, =4.7.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 - org.apache.karaf.cellar.samples.camel.hazelcast:consumer 4.4.8 - org.apache.karaf.cellar.samples.camel.hazelcast:producer 4.4.8 Source cves: CVE-2026-78162 Source advisory:...

CVE-2026-78162

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

org.apache.camel.quarkus:camel-quarkus-hazelcast (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-hazelcast-deployment (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.19.0, <=4.22.0)

org.apache.camel:camel-hazelcast MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78162 Source advisory: MEND:CVE-2026-78162...

CVE-2026-78162

Apache Camel's camel-hazelcast component (specifically camel-hazelcast-starter and camel-quarkus-hazelcast) is vulnerable to CWE-502 Deserialization of Untrusted Data. The root cause is an incomplete fix for CVE-2026-43865 where two configuration paths—ReplicatedHazelcastAggregationRepository#doS...

EUVD-2026-104224

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

org.apache.camel.karaf:camel-hazelcast (>=4.18.1, <=4.18.4), org.apache.camel.karaf:camel-hazelcast-test (>=4.18.1, <=4.18.4) +4 more potentially affected by CVE-2026-78162 via org.apache.camel:camel-hazelcast (>=4.15.0, <=4.18.4)

org.apache.camel:camel-hazelcast MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.4 Source cves: CVE-2026-78162 Source advisory: MEND:CVE-2026-78162...

PT-2026-117327

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description The camel-hazelcast component fails to apply a JavaSerializationFilterConfig to Hazelcast instances created through specific configuration paths...

CVE-2026-78162: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the managed Hazelcast instance creation paths in HazelcastDefaultComponentgetOrCreateHzInstance, HazelcastUtilnewInstance, HazelcastAggregationRepositorydoStart, and...

org.apache.camel.karaf:camel-hazelcast (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-hazelcast-test (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.15.0, <=4.18.2)

org.apache.camel:camel-hazelcast MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-43865 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892565...

org.apache.camel.quarkus:camel-quarkus-hazelcast (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-hazelcast-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.19.0, <=4.20.0)

org.apache.camel:camel-hazelcast MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43865 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892565...

org.apache.camel.karaf:camel-hazelcast (>=4.7.0, <=4.14.7), org.apache.camel.karaf:camel-hazelcast-test (>=4.7.0, <=4.14.7) +6 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.0.0, <=4.14.7)

org.apache.camel:camel-hazelcast MAVEN version =4.0.0, =4.7.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 - org.apache.karaf.cellar.samples.camel.hazelcast:consumer 4.4.8 - org.apache.karaf.cellar.samples.camel.hazelcast:producer 4.4.8 Source cves: CVE-2026-43865 Source advisory:...

org.apache.camel.karaf:camel-hazelcast (>=4.18.1, <=4.18.2), org.apache.camel.karaf:camel-hazelcast-test (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.15.0, <=4.18.2)

org.apache.camel:camel-hazelcast MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-43865 Source advisory: GHSA-XWW8-MXQW-M84W...

org.apache.camel.quarkus:camel-quarkus-hazelcast (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-hazelcast-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.19.0, <=4.20.0)

org.apache.camel:camel-hazelcast MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43865 Source advisory: OSV:GHSA-XWW8-MXQW-M84W...

org.apache.camel.quarkus:camel-quarkus-hazelcast (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-hazelcast-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.19.0, <=4.20.0)

org.apache.camel:camel-hazelcast MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43865 Source advisory: GHSA-XWW8-MXQW-M84W...

org.apache.camel.karaf:camel-hazelcast (>=4.7.0, <=4.14.7), org.apache.camel.karaf:camel-hazelcast-test (>=4.7.0, <=4.14.7) +6 more potentially affected by CVE-2026-43865 via org.apache.camel:camel-hazelcast (>=4.0.0, <=4.14.7)

org.apache.camel:camel-hazelcast MAVEN version =4.0.0, =4.7.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 - org.apache.karaf.cellar.samples.camel.hazelcast:consumer 4.4.8 - org.apache.karaf.cellar.samples.camel.hazelcast:producer 4.4.8 Source cves: CVE-2026-43865 Source advisory:...