CVE-2026-78165
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
02 Description
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
03 Exploitation and scoring
- Exploitation
- Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.
- SSVC decision
- ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.72% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 53.8% of scored records. A rank, not a probability.
- NVD base score
- 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Undergoing Analysis. NVD last modified this record on 2026-10-20.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-19 10:08Z10 DAYS AGO
- Last updated
- 2026-10-20 13:08Z8 DAYS AGO
- Reserved
- 2026-08-23
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502Deserialization of Untrusted DataBase
- Data version
- 5.2
- Document digest
- 5c88a3b36ed0baa94d9b69272f83ff679980d8f49772ef3df907cb08c7798541
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-78165https://camel.apache.org/security/CVE-2026-78165.html
- issues.apache.orgCAMEL-24421https://issues.apache.org/jira/browse/CAMEL-24421
- github.comFix on main, released in 4.23.0 (commit 8db602a5ee105403fa40c1b821157c8d9d0c1977)https://github.com/apache/camel/pull/25587
- github.comBackport to camel-4.22.x, released in 4.22.1 (commit b2ba1ed90562e10e07bfb4a3cab60b817885e6de)https://github.com/apache/camel/pull/25588
- github.comBackport to camel-4.18.x, released in 4.18.5 (commit e721141ddcaeb9a08892730942b1b362c2da1c5c)https://github.com/apache/camel/pull/25589
- github.comUpgrade-guide documentation placed on main (commit ddc7885a7add93326b3d549c565c43bbccad12dc)https://github.com/apache/camel/pull/25734
- github.comhttps://github.com/oscerd/CVE-2026-78165
07 Remediation
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x releases stream should upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. A new deserializationFilter endpoint option controls the filter applied while the default serializer reads Redis payloads; when it is not set, the JVM-wide jdk.serialFilter is honoured if present, and otherwise a conservative default allow-list is applied that permits standard Java and Apache Camel types and denies java.net. On 4.23.0 and 4.22.1 the default additionally enforces the JEP-290 graph-shape limits maxdepth, maxrefs and maxbytes; on 4.18.5 the equivalent local constant is applied without those limits. Because JdkSerializationRedisSerializer exposes no hook for installing a filter, the serializer is constructed through its Converter-based constructor with a deserializing converter that sets the filter on the stream before the graph is read. The single change covers the consumer, the producer read commands and SpringRedisIdempotentRepository.