CVE-2026-78165

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.11.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description An issue exists in the Apache Camel Spring Redis component where untrusted data is deserialized. The RedisConfiguration.getSerializer method creates a JdkSerializationRedisSerializer by default when no serializer is configured. This implementation uses a ConfigurableObjectInputStream without a java.io.ObjectInputFilter, allowing an arbitrary serialized class graph to be materialized and its readObject() method to be executed. The RedisConsumer.setBody function applies this serializer to raw bytes of messages published to subscribed channels, enabling an attacker to reach the deserialization sink via a PUBLISH command. Additionally, the RedisTemplate created by RedisConfiguration.createDefaultTemplate and the SpringRedisIdempotentRepository use the same default serializer, affecting producer read commands such as GET, HGET, HGETALL, and HVALS. Configuring a custom redisTemplate does not mitigate the consumer path because RedisConsumer.setBody accesses getSerializer directly.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.1 for those on the 4.22.x stream. Upgrade to version 4.18.5 for those on the 4.18.x stream. For versions 4.14.x and earlier, migrate to a supported release. Set the JVM-wide jdk.serialFilter system property to restrict deserialization. Set the serializer endpoint option to a non-Java serialization serializer, such as StringRedisSerializer. Require authentication on the Redis instance and restrict clients that may publish to subscribed channels. Avoid exposing the Redis instance consumed by Camel to untrusted networks.