Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the FileBasedKeyLifecycleManager class while handling contents of .key files. An attacker can execute arbitrary code by placing a crafted serialized Java object in the key directory, which is then...

EUVD-2026-25790

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...