Loading story…
A deserialization vulnerability tracked as CVE-2026-25747 affects the Apache Camel LevelDB component and can lead to arbitrary code execution. Red Hat rated the issue Important with a CVSS v3 score of 7.8, stating the flaw stems from Camel-LevelDB using java.io.ObjectInputStream to read LevelDB aggregation repository data without validation or class-loading restrictions. If an attacker can write a malicious serialized Java object into the LevelDB database files, the application may deserialize it and execute attacker-controlled code.
Red Hat said no acceptable mitigation is currently available under its product security criteria. In its product status matrix, Red Hat build of Apache Camel for Spring Boot 4 and Red Hat Fuse 7 are marked Will not fix, while Red Hat JBoss Enterprise Application Platform 8 and the JBoss Enterprise Application Platform Expansion Pack are listed as Not affected because the vulnerable component is not present. The issue is cataloged in the CVE program as CVE-2026-25747.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat last modified its CVE-2026-25747 record, stating no acceptable mitigation was available and marking Red Hat build of Apache Camel for Spring Boot 4 and Red Hat Fuse 7 as 'Will not fix' while listing certain JBoss products as not affected. The update also reflected Red Hat's product impact matrix and issue tracking details.
Red Hat published CVE-2026-25747 for a deserialization flaw in the Apache Camel LevelDB component that can lead to arbitrary code execution if an attacker can write to LevelDB database files. Red Hat rated the issue Important with a CVSS v3 score of 7.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-40048**, an unsafe deserialization flaw in the Camel-PQC component of Apache Camel that can lead to arbitrary code execution. The vulnerability is in `FileBasedKeyLifecycleManager`, which deserializes `<keyId>.key` files with `java.io.ObjectInputStream` without `ObjectInputFilter` or class-loading restrictions, allowing malicious `readObject()` behavior to run before the data is cast to `java.security.KeyPair`. An attacker who can place a crafted file in the configured key directory—through path traversal, weak filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—could execute code in the context of the Camel application. The issue affects `org.apache.camel:camel-pqc` versions **4.19.0 before 4.20.0** and **4.18.0 before 4.18.2**. Apache fixed the flaw by replacing `ObjectInputStream`-based key and metadata storage with **PKCS#8** and **X.509 SubjectPublicKeyInfo** Base64 JSON encoding, and advised users to upgrade to **4.20.0** or **4.18.2** on the 4.18.x LTS line. Apache credited Andrea Cosentino of the Apache Software Foundation and Venkatraman Kumar of Securin with discovering the vulnerability.
Jun 29, 2026
Apache disclosed three unsafe deserialization vulnerabilities in **Apache Camel** that can lead to remote code execution in deployments using `camel-mina`, JMS-related components, and `camel-infinispan`. **CVE-2026-40473** affects `camel-mina`, where `MinaConverter.toObjectInput()` wraps network-supplied TCP or UDP data in `java.io.ObjectInputStream` without `ObjectInputFilter` or class-loading restrictions; a crafted serialized Java object can execute during `readObject()`. **CVE-2026-40860** affects `camel-jms`, `camel-sjms`, `camel-sjms2`, and `camel-amqp`, where Camel deserializes JMS `ObjectMessage` payloads through `ObjectMessage.getObject()` with the default `mapJmsMessage` option enabled and without filtering or allow/deny lists, allowing an attacker who can publish to a consumed queue or topic to trigger code execution if a gadget chain is present. Apache also disclosed **CVE-2026-40858** in `camel-infinispan`, where the ProtoStream-based remote aggregation repository deserializes data from a remote Infinispan cache using `java.io.ObjectInputStream` without an input filter; an attacker able to write to the cache can inject a malicious serialized object that executes during normal `get` or `recover` operations. The affected versions span multiple Camel release lines, including `3.0.0` and later for the JMS issue, `3.0.0` and later for `camel-mina`, and `4.0.0` and later for `camel-infinispan`, with fixes released in **4.20.0** and backported to supported streams including **4.14.6/4.14.7** and **4.18.2**. Apache tracks the flaws as `CAMEL-23319`, `CAMEL-23321`, and `CAMEL-23322`, with reports credited to researchers from **Securin** and **Innora Pte. Ltd.**
Jun 29, 2026
Apache Commons Collections contained a critical unsafe-deserialization vulnerability, **CVE-2015-7501**, in its serializable `InvokerTransformer` component. An attacker able to supply crafted serialized Java objects to exposed endpoints—including JMX, RMI, or remote EJB services—could chain vulnerable classes with `sun.reflect.annotation.AnnotationInvocationHandler` to execute arbitrary code under the permissions of the affected Java application. The flaw affected Commons Collections 3.0 and 4.0 and exposed products and applications using the library, including WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS. Apache addressed the issue in Commons Collections versions 3.2.2 and 4.1 by preventing `InvokerTransformer` transformations following deserialization. Red Hat also issued a critical update for JBoss Operations Network 3.3.4, directing customers to shut down and patch every server individually, including each node in high-availability deployments. Organizations should identify applications that deserialize untrusted Java objects and either upgrade the library or apply vendor-provided patches.
Aug 29, 2026