Venkatraman Kumar

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.2 **Description** A general user can mint admin access tokens through the '/access-tokens' endpoint. **Recommendations** Upgrade to version 3.4.2.

**Name of the Vulnerable Software and Affected Versions** Apache Allura versions prior to 1.20.0 **Description** An unauthenticated REST disclosure allows the exposure of certain content items within the application. **Recommendations** Upgrade to version 1.20.0.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.14.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist. **Recommendations** For versions 4.14.0.0 through 4.20.3.0, upgrade to version 4.20.3.1 or later. For versions 4.21.0.0 through 4.22.1.0, upgrade to version 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.19.9 **Description** The `camel-vertx-http` component deserializes HTTP response bodies with the `application/x-java-serialized-object` Content-Type using a raw `java.io.ObjectInputStream` without an `ObjectInputFilter` in the `deserializeJavaObjectFromStream()` function. This occurs when the producer endpoint is configured with `transferException=true` (or `allowJavaSerializedObject=true`) and `throwExceptionOnFailure` is set to true. In these conditions, a backend HTTP response with a 5xx status and the specified content type is deserialized without class restrictions. An attacker controlling the backend or performing a man-in-the-middle attack on an unencrypted HTTP connection can send a crafted serialized Java object to achieve remote code execution on the host, provided a suitable gadget chain exists on the classpath. **Recommendations** Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. Upgrade to version 4.20.0. Do not enable `transferException=true` or `allowJavaSerializedObject=true` on producers communicating with untrusted or network-reachable backends. Ensure producer connections use TLS (https) to prevent man-in-the-middle response substitution. Set an explicit `-Djdk.serialFilter` allow-list to constrain deserialization.

☕ Apache Camel critical alert: CVE-2026-43867 hits the camel-pqc component. Post-quantum key metadata deserialized via ObjectInputStream with zero ObjectInputFilter — unauthenticated RCE risk at CVSS 9.8. Check your Camel builds now. #AppSec #Apache https://t.co/iaMBNrOfI0 https://t.co/mkIJ19Sd5Y

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 **Description** An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in several components allows classes that perform network I/O, such as `java.net.URL` and `java.net.InetAddress`. An attacker can send a Java-serialized payload containing a `HashMap` with `java.net.URL` keys to an affected consumer. This triggers the JVM to issue DNS queries to an attacker-controlled host during deserialization, creating an out-of-band side channel. The risk is most significant in the `camel-jms` family because the `extractBodyFromJms()` function in `JmsBinding` unconditionally invokes `getObject()` when the `mapJmsMessage` variable is set to true. Affected components include `camel-jms`, `camel-sjms`, `camel-amqp`, `camel-mina`, `camel-netty`, `camel-netty-http`, `camel-vertx-http`, `camel-infinispan`, and aggregation repository components `camel-leveldb`, `camel-cassandraql`, `camel-consul`, and `camel-sql`. **Recommendations** Update Apache Camel versions 4.14.0 through 4.14.7 to version 4.14.8. Update Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Update Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. Configure a JMS-provider-side allow-list using `deserializationAllowList` or `deserializationDenyList` in Apache ActiveMQ Artemis, or `org.apache.activemq.SERIALIZABLE PACKAGES` in Apache ActiveMQ Classic. Override the default filter via the `deserializationFilter` option at the endpoint level or the `-Djdk.serialFilter` JVM system property using the pattern `!java.net.**;java.**;javax.**;org.apache.camel.**;!*` (or `!java.net.**;java.**;org.apache.camel.**;!*` for aggregation-repository components).

**Name of the Vulnerable Software and Affected Versions** Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 **Description** The `EndpointReferenceUtils` and `W3CMultiSchemaFactory` classes construct a `SAXParserFactory` without the required JAXP hardening configurations. This allows for out-of-band (OOB) external entity resolution, a process where an XML parser is tricked into accessing external resources via external entities. **Recommendations** Upgrade to version 4.2.2. Upgrade to version 4.1.7.

**Name of the Vulnerable Software and Affected Versions** Apache Fory fory-core versions prior to 1.1.0 **Description** Deserialization of untrusted data in the Java replace-resolve path on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks. By using crafted Fory serialized data, an attacker can invoke `readResolve()` and `readExternal()` hooks present on the classpath. **Recommendations** Upgrade to version 1.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1 **Description** The `FileBasedKeyLifecycleManager` class in Camel-PQC performs insecure deserialization of untrusted data. It deserializes the contents of `<keyId>.key` files in the configured key directory using `java.io.ObjectInputStream` without applying an `ObjectInputFilter` or class-loading restrictions. Because the cast to `java.security.KeyPair` occurs only after the `readObject()` function has returned, any side effects within the deserialized object are executed before the type check. An attacker capable of writing to the key directory—via path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—can place a crafted serialized Java object to achieve arbitrary code execution within the application context. **Recommendations** Upgrade to version 4.20.0. Upgrade to version 4.18.2.

**Name of the Vulnerable Software and Affected Versions** Apache MINA versions 2.0.0 through 2.0.27 Apache MINA versions 2.1.0 through 2.1.10 Apache MINA versions 2.2.0 through 2.2.5 **Description** An issue exists in the `getObject()` function of the `AbstractIoBuffer` class due to an incomplete deserialization mechanism. The classname allowlist, which restricts which classes can be deserialized, is applied too late, potentially allowing a static initializer in a class to be executed before the check occurs. This flaw allows a remote attacker to execute arbitrary code on applications that call the `getObject()` function. **Recommendations** Update to version 2.0.28 for versions 2.0.0 through 2.0.27. Update to version 2.1.11 for versions 2.1.0 through 2.1.10. Update to version 2.2.6 for versions 2.2.0 through 2.2.5. As a temporary workaround, restrict the use of the `getObject()` function.

**Name of the Vulnerable Software and Affected Versions** Apache MINA versions 2.0.0 through 2.0.27 Apache MINA versions 2.1.0 through 2.1.10 Apache MINA versions 2.2.0 through 2.2.5 **Description** A flaw in the `resolveClass()` function of `AbstractIoBuffer` allows a bypass of the classname allowlist for static classes or primitive types. This occurs because one of the execution branches fails to validate the class, enabling unsafe deserialization when applications call `IoBuffer.getObject()`. This can lead to remote code execution. **Recommendations** Upgrade to version 2.0.28 for versions 2.0.0 through 2.0.27. Upgrade to version 2.1.11 for versions 2.1.0 through 2.1.10. Upgrade to version 2.2.6 for versions 2.2.0 through 2.2.5.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 3.0.0 through 4.14.6 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.x **Description** The `extractBodyFromJms()` function in `camel-jms` and the `JmsBinding` class in `camel-sjms` deserialize the payload of incoming JMS ObjectMessage values via `javax.jms.ObjectMessage.getObject()` without using an ObjectInputFilter, class allowlist, or class denylist. This occurs when the `mapJmsMessage` option is enabled and the application acts as a JMS consumer. An attacker could publish a crafted ObjectMessage to a queue or topic to achieve remote code execution if a deserialization gadget chain is present on the classpath. This issue also affects `camel-sjms2`, `camel-amqp`, `camel-activemq`, and `camel-activemq6`. **Recommendations** Upgrade to version 4.14.7 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x releases stream. Upgrade to version 4.20.0 for all other affected versions.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 3.0.0 through 4.14.5 Apache Camel versions 4.15.0 through 4.18.1 Apache Camel versions 4.19.0 through 4.19.9 **Description** A flaw in the camel-mina component allows a remote attacker to achieve arbitrary code execution by sending a specially crafted serialized Java object over the network to the MINA consumer port. The `MinaConverter.toObjectInput()` type converter, used when a Camel route processes network input, fails to apply necessary security filters or class-loading restrictions during object deserialization. This occurs when the converter wraps an `IoBuffer` in a `java.io.ObjectInputStream` without an `ObjectInputFilter`, enabling malicious code execution within the application context during the `readObject()` process. **Recommendations** Upgrade to version 4.14.6 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x releases stream. Upgrade to version 4.20.0 for all other affected versions.