Loading vulnerability…
Untrusted Java Deserialization in Apache Camel Spring Redis
CVE-2026-78165 is an untrusted Java deserialization vulnerability in Apache Camel's Spring Redis component, affecting versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. When no serializer endpoint option is configured, RedisConfiguration.getSerializer creates a JdkSerializationRedisSerializer that deserializes objects without a per-stream ObjectInputFilter. RedisConsumer.setBody applies this serializer to subscribed Redis messages before constructing the Camel Exchange, preventing route-level validation from intercepting malicious serialized objects. The same default serializer supports producer read operations GET, HGET, HGETALL, and HVALS, as well as SpringRedisIdempotentRepository. A safe serializer configured only on a custom RedisTemplate does not protect the consumer path. Attacker-controlled serialized class graphs can trigger readObject methods and potentially arbitrary code execution when suitable classes are available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can execute deserialization callbacks in the Camel application's JVM and, where suitable gadget classes are available, enable arbitrary code execution with the application's privileges. This can compromise application-accessible data, alter application state, and disrupt service availability. Both subscribed Redis messages and attacker-controlled stored values can expose affected applications; consumer-side exploitation occurs before Camel route logic can validate the message.
If you can’t patch tonight, do this now.
Explicitly configure the serializer endpoint option to use a serializer that does not perform Java deserialization, such as StringRedisSerializer. Configuring a safe serializer only on a custom RedisTemplate is insufficient for consumers. Alternatively, configure a restrictive JVM-wide jdk.serialFilter policy; the affected ObjectInputStream-based path honors this property. As defense in depth, require Redis authentication, restrict publish permissions on subscribed channels and write access to application-consumed data, and prevent untrusted network access to the Redis instance.
Patch, then assume compromise.
Upgrade to Apache Camel 4.23.0, or to the fixed maintenance release for the deployed stream: 4.22.1 for 4.22.x or 4.18.5 for 4.18.x. Apache Camel 4.14.x and earlier release streams are end of life and will not receive a fix; migrate those deployments to a supported, fixed release.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.