CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

PT-2026-55884

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a...

com.themodernway:themodernway-server-core (>=1.0.8-release, <=1.0.14-release), com.themodernway:themodernway-server-hazelcast (>=1.0.8-release, <=1.0.12-release) +6 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.9.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.themodernway:themodernway-server-core...

com.ahome-it:ahome-tooling-server-core (>=1.1.2-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.2-release, <=1.1.3-release) +5 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.0.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.12-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.4-release, <=1.1.12-release) +5 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.1.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

com.themodernway:themodernway-server-core (>=1.0.1-release, <=1.0.7-release), com.themodernway:themodernway-server-hazelcast (>=1.0.5-release, <=1.0.7-release) +35 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.8.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.themodernway:themodernway-server-core...

com.github.edgarespina:mwa-mongo (>=0.1.0, <=0.1.6), com.github.edgarespina:mwa-morphia (>=0.1.0, <=0.1.6) +6 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.0.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.1.0, =0.1.0, =2.1, =0.1.0,...

com.github.edgarespina:mwa-mongo (>=0.1.0, <=0.1.6), com.github.edgarespina:mwa-morphia (>=0.1.0, <=0.1.6) +6 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.1.0, =0.1.0, =2.1, =0.1.0,...

com.ahome-it:ahome-tooling-server-core (>=1.1.14-release, <=1.1.18-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.14-release, <=1.1.17-release) +6 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.6.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.14-release, =1.1.14-release,...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-release, <=1.1.3-release) +6 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.1-release, =1.1.1-release,...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-release, <=1.1.3-release) +6 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.6.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.1-release, =1.1.1-release,...

com.aerse:gcless (11.2), com.hazelcast:hazelcast-wm (>=3.4, <=3.8.3) +99 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.1.release)

org.springframework.security:spring-security-web MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.aerse:gcless 11.2 - com.hazelcast:hazelcast-wm =3.4...

com.ahome-it:ahome-tooling-server-core (>=1.0.94-release, <=1.0.108-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.100-release, <=1.0.107-release) +16 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.1.7.release)

org.springframework:spring-jms MAVEN version 4.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.0.94-release, =1.0.100-release, =1.0.96-release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

com.ahome-it:ahome-tooling-server-core (1.0.121-release), com.ahome-it:ahome-tooling-server-hazelcast (1.0.121-release) +5 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.2.release)

org.springframework:spring-websocket MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.0.121-release -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +6 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.0.release)

org.springframework:spring-websocket MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.4, <=2.5), com.themodernway:themodernway-server-core (>=1.0.1-release, <=1.0.5-release) +55 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.7.release)

org.springframework:spring-websocket MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.4, =1.0.1-release, =1.0.1.1-releas...

com.hazelcast.simulator:dist (>=0.5, <=0.6), com.hazelcast.simulator:hazelcast-simulator-dist (0.4) +20 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.54)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.hazelcast.simulator:dist =0.5, =0.5, =2.1, =0.4.0, =1.0.4, =1.0.5, =1.1.2, =1.1.2, =1.2....