CVE-2026-40858

camel-infinispan 远程聚合存储库不安全反序列化复现工具 CVE-2026-40858 本项目演示了 Apache Camel 的 camel-infinispan 组件中的一个 Java 反序列化漏洞 ，追踪编号为 CVE-2026-40858 。基于 ProtoStream 的 远程聚合存储库 将每个聚合的 Exchange 序列化到远程 Infinispan 缓存中，当它读回一个条目时（在 get / recover 时），使用 java.io.ObjectInputStream 且 没有ObjectInputFilter...

CVE-2026-40858 Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a...

PT-2026-34329

Name of the Vulnerable Software and Affected Versions camel-infinispan affected versions not specified Description Unsafe deserialization exists in the ProtoStream remote aggregation repository. A remote attacker with low privileges can send specially crafted data to achieve arbitrary code...