Deserialization Of Untrusted Data

Apache Camel is vulnerable to Unsafe Deserialization. The vulnerability is due to deserialization of untrusted data in ConsulRegistryUtils.deserialize using ObjectInputStream.readObject without applying an ObjectInputFilter, allowing attackers with write access to the Consul KV store to inject...

GHSA-5RC6-9QFP-8VWG Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ConsulRegistryUtils.deserialize method which fails to without apply an ObjectInputFilter. An attacker can execute arbitrary code by injecting a malicious serialized Java object into the Consul K...

CVE-2026-27172

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

CVE-2026-27172

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

CVE-2026-27172 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

CVE-2026-27172

CVE-2026-27172 affects Apache Camel, Camel-Catalog: the ConsulRegistry reads Java-serialized values from the Consul KV store and deserializes them via ObjectInputStream.readObject() without an ObjectInputFilter. An attacker with write access to the backing KV store can inject a malicious serializ...

CVE-2026-27172 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

CVE-2026-27172 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

PT-2026-35393

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

Apache Camel 代码问题漏洞

Apache Camel is an open-source integration framework based on the Enterprise Integration Pattern EIP, developed by the Apache Foundation in the United States. This framework provides implementations of Java objects following the EIP pattern and allows routing and mediation rules to be configured...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, authentik, crossplane-provider-aws-kendra, cert-manager-openshift-routes, crossplane-provider-aws-route53, vexctl, crossplane-provider-aws-acm, gitlab-operator-fips, go-discover, kyverno, gcp-compute-persistent-disk-csi-driver-fips,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: cluster-api, rancher-agent, kubernetes, istio, docker-cli-buildx, zarf, kwok, envoy-gateway, percona-server-mongodb-operator, infinispan-operator, kiali, cri-tools, cilium, gitlab-kas, kubevela, cloudnative-pg, sonobuoy, teleport, kubernetes-dashboard-api,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: cluster-api, rancher-agent, kubernetes, istio, docker-cli-buildx, zarf, kwok, envoy-gateway, percona-server-mongodb-operator, infinispan-operator, kiali, cri-tools, cilium, gitlab-kas, kubevela, cloudnative-pg, sonobuoy, teleport, kubernetes-dashboard-api,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, gpu-operator-fips, k9s, argo-workflows-fips, kubernetes-dashboard-api-fips, kubescape, rke2-runtime, tigera-operator-fips, argo-workflows, cloudnative-pg, hubble-fips, falcoctl-fips, envoy-gateway-fips, jitsucom-bulker, cluster-api, rke2-runtime-fips,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, gpu-operator-fips, k9s, argo-workflows-fips, kubernetes-dashboard-api-fips, kubescape, rke2-runtime, tigera-operator-fips, argo-workflows, cloudnative-pg, hubble-fips, falcoctl-fips, envoy-gateway-fips, jitsucom-bulker, cluster-api, rke2-runtime-fips,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: istio, nova, cert-manager-cmctl, zarf, envoy-gateway, chart-testing, helm-docs, cluster-api-helm-controller, harbor, helm-operator, flux, flux-source-controller, tw, k8ssandra-client, cilium-cli, chartmuseum, helm-mapkubeapis, kubescape, tigera-operator, helm-push,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: istio, nova, cert-manager-cmctl, zarf, envoy-gateway, chart-testing, helm-docs, cluster-api-helm-controller, harbor, helm-operator, flux, flux-source-controller, tw, k8ssandra-client, cilium-cli, chartmuseum, helm-mapkubeapis, kubescape, tigera-operator, helm-push,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: kube-arangodb, trivy, cloudbeat-fips, linkerd2, chaos-mesh, cluster-api-helm-controller-fips, nova-fips, cert-manager-cmctl-fips, zot, k9s, harbor, pluto-fips, k8ssandra-client-fips, kots, kubescape, teleport, consul-k8s-fips, nova, tigera-operator-fips,...