CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signature verification bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the PQC producer held a singlejava.security.Signature instance and used it for every exchange without synchronization. Signature is...

CVE-2026-85300

CVE-2026-85300 — camel-pqc: private key written with permissive file permissions Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-pqc's FileBasedKeyLifecycleManager wrote generated key material to disk with the permissions the process default umask produced ,...

CVE-2026-46590

CVE-2026-46590 — camel-pqc Key-Lifecycle Unsafe Deserialization Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-pqc 4.18.2 Camel Quarkus|...

CVE-2026-40048

camel-pqc FileBasedKeyLifecycleManager Unsafe Deserialization Reproducer CVE-2026-40048 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-pqc component, tracked as CVE-2026-40048. FileBasedKeyLifecycleManager reads .key files from the configured key directory...

CVE-2026-43867

camel-pqc AWS Secrets Manager Key-Metadata Unsafe Deserialization Reproducer CVE-2026-43867 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-pqc component, tracked as CVE-2026-43867. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads persisted...

Exploit for CVE-2026-85300

CVE-2026-85300 — camel-pqc: private key written with permissiv...

Apache Camel 4.22.0 camel-pqc Private Key Permissions

Apache Camel camel-pqc versions from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 write unencrypted private keys using default file permissions, allowing local accounts to read them under a permissive umask. A proof of concept is included. https://packetstorm.news/download/236481...

org.apache.camel.karaf:camel-pqc (>=4.14.5, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.24.0, <=3.33.3) +2 more potentially affected by CVE-2026-85248 via org.apache.camel:camel-pqc (>=4.12.0, <=4.18.4)

org.apache.camel:camel-pqc MAVEN version =4.12.0, =4.14.5, =3.24.0, =3.24.0, =4.12.0, =4.18.4 Source cves: CVE-2026-85248 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429358...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-85248 via org.apache.camel:camel-pqc (>=4.19.0, <=4.22.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85248 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429358...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the PQCProducer class in the camel-pqc component. An attacker can cause verification to report success for a message whose signature was not actually checked against that message by sending concurrent exchanges throug...

org.apache.camel.karaf:camel-pqc (>=4.14.5, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.24.0, <=3.33.3) +2 more potentially affected by CVE-2026-85300 via org.apache.camel:camel-pqc (>=4.12.0, <=4.18.4)

org.apache.camel:camel-pqc MAVEN version =4.12.0, =4.14.5, =3.24.0, =3.24.0, =4.12.0, =4.18.4 Source cves: CVE-2026-85300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430132...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-85300 via org.apache.camel:camel-pqc (>=4.19.0, <=4.22.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430132...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the FileBasedKeyLifecycleManager in the PQC component. When it stores generated key material, a process umask that permits group or world access leaves the directory and unencrypted private-key JSON fil...

Exploit for CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signa...

org.apache.camel.karaf:camel-pqc (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.30.0, <=3.33.3) +2 more potentially affected by CVE-2026-85300 via org.apache.camel:camel-pqc (>=4.16.0, <=4.18.4)

org.apache.camel:camel-pqc MAVEN version =4.16.0, =4.18.1, =3.30.0, =3.30.0, =4.16.0, =4.18.4 Source cves: CVE-2026-85300 Source advisory: MEND:CVE-2026-85300...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-85300 via org.apache.camel:camel-pqc (>=4.19.0, <=4.22.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85300 Source advisory: MEND:CVE-2026-85300...

org.apache.camel.karaf:camel-pqc (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.29.0, <=3.33.3) +2 more potentially affected by CVE-2026-85248 via org.apache.camel:camel-pqc (>=4.15.0, <=4.18.4)

org.apache.camel:camel-pqc MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.4 Source cves: CVE-2026-85248 Source advisory: MEND:CVE-2026-85248...

org.apache.camel.quarkus:camel-quarkus-integration-test-pqc (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-pqc (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-85248 via org.apache.camel:camel-pqc (>=4.19.0, <=4.22.0)

org.apache.camel:camel-pqc MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85248 Source advisory: MEND:CVE-2026-85248...

Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

camel-pqc Apache Camel Component Code Execution

The vulnerability of the camel-pqc component in the Apache Camel Java framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...