CVE-2026-43865

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a Java deserialization filter. When Camel builds the Hazelcast Config without a user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean, objects received via the Hazelcast cluster protocol are deserialized using ObjectInputStream.readObject() before processing. An attacker capable of joining or reaching the Hazelcast cluster can send a crafted serialized Java object, leading to remote code execution on every Camel node. This issue affects any route using a hazelcast consumer (including hazelcast-topic, hazelcast-queue, hazelcast-seda, hazelcast-map, hazelcast-multimap, hazelcast-replicatedmap, hazelcast-list, and hazelcast-set), as well as the HazelcastAggregationRepository and HazelcastIdempotentRepository, when the managed instance uses the default configuration.

Recommendations Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. Upgrade to version 4.21.0 for all other affected versions. Configure a deserialization filter on the Hazelcast instance via Hazelcast JavaSerializationFilterConfig or the JVM-wide system property -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*. Enable Hazelcast cluster authentication and TLS to restrict cluster access.