CVE-2026-85248

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.12.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description A race condition exists in the PQC component where the producer uses a single java.security.Signature instance for every exchange without proper synchronization. Because the Signature class is stateful and not thread-safe, the update() function (which accumulates data) and the verify() function (which consumes the state) can interleave when multiple exchanges occur concurrently. This non-deterministic behavior can lead to a verification reporting success for a message whose signature was not actually checked, compromising the security guarantees of the component. This issue is triggered by concurrent traffic through the same endpoint.

Recommendations Upgrade Apache Camel versions 4.12.0 through 4.18.4 to 4.18.5. Upgrade Apache Camel versions 4.19.0 through 4.22.0 to 4.22.1. Upgrade to Apache Camel version 4.23.0. Restrict the affected route to a single concurrent consumer to prevent multiple exchanges from using the java.security.Signature instance simultaneously.