CVE-2026-85245

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description The Thrift component unmarshalled incoming data into a shared defaultInstance of the target type instead of a fresh copy, returning this shared object as the exchange body. Since the instance is shared process-wide, state from one message remained on the object and became visible to subsequent messages using the same type. This allows content from one sender to be read during the processing of another sender's message, or for concurrent exchanges to observe partially written state, leading to data disclosure in multi-tenant or multi-user deployments.

Recommendations Upgrade to version 4.18.5 for users on the 4.18.x LTS stream. Upgrade to version 4.22.1 for users on the 4.22.x LTS stream. Upgrade to version 4.23.0. As a temporary workaround, copy the unmarshalled body into a new instance immediately after the data format runs and avoid retaining references to the returned object.