CVE-2026-78162

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description The camel-hazelcast component fails to apply a JavaSerializationFilterConfig to Hazelcast instances created through specific configuration paths. This occurs when ReplicatedHazelcastAggregationRepository overrides the doStart() function without calling the super method, and when HazelcastDefaultComponent#getOrCreateHzClientInstance() builds a ClientConfig while hazelcastMode is set to client without a referenced ClientConfig or hazelcastConfigUri. Consequently, Java deserialization remains unrestricted. An attacker capable of publishing data to the connected Hazelcast cluster can trigger the deserialization of a crafted Java object within the serialization layer, leading to remote code execution. This risk is heightened as Hazelcast clusters do not enable authentication or TLS by default.

Recommendations Upgrade to version 4.18.5 for the 4.18.x releases stream. Upgrade to version 4.22.1 for the 4.22.x releases stream. Upgrade to version 4.23.0. Supply an explicit Hazelcast configuration containing a JavaSerializationFilterConfig or inject a pre-built HazelcastInstance. Set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!*. Enable Hazelcast cluster authentication and TLS.