Read the docs
TI-2015-04502 Aliases CVE-2015-5348GHSA-26v6-w6fw-rh94

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when…

Priority MEDIUM 45CWE-19Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

Why it matters now

EPSS 0.06365 93rd percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-jetty (Maven): 2.15.5, 2.16.1org.apache.camel:camel-servlet (Maven): 2.15.5, 2.16.1+4 more productsRed Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.camel:camel-jetty (Maven)before 2.15.52.15.5Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-jetty (Maven)2.16.0 to before 2.16.12.16.1Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-servlet (Maven)before 2.15.52.15.5Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-servlet (Maven)2.16.0 to before 2.16.12.16.1Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-http (Maven)before 2.15.52.15.5Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-http (Maven)2.16.0 to before 2.16.12.16.1Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-http-common (Maven)before 2.15.52.15.5Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-http-common (Maven)2.16.0 to before 2.16.12.16.1Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-http4 (Maven)before 2.15.52.15.5Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-http4 (Maven)2.16.0 to before 2.16.12.16.1Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-ahc (Maven)before 2.15.52.15.5Patch availableGHSA-26v6-w6fw-rh94
—org.apache.camel:camel-ahc (Maven)2.16.0 to before 2.16.12.16.1Patch availableGHSA-26v6-w6fw-rh94
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.camel:camel-jetty (Maven) Vendor— Affected before 2.15.5 Fixed in 2.15.5 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-jetty (Maven) Vendor— Affected 2.16.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-servlet (Maven) Vendor— Affected before 2.15.5 Fixed in 2.15.5 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-servlet (Maven) Vendor— Affected 2.16.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-http (Maven) Vendor— Affected before 2.15.5 Fixed in 2.15.5 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-http (Maven) Vendor— Affected 2.16.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-http-common (Maven) Vendor— Affected before 2.15.5 Fixed in 2.15.5 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-http-common (Maven) Vendor— Affected 2.16.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-http4 (Maven) Vendor— Affected before 2.15.5 Fixed in 2.15.5 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-http4 (Maven) Vendor— Affected 2.16.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-ahc (Maven) Vendor— Affected before 2.15.5 Fixed in 2.15.5 Patch available GHSA-26v6-w6fw-rh94
  • org.apache.camel:camel-ahc (Maven) Vendor— Affected 2.16.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-26v6-w6fw-rh94

CPE configurations NVD · 58

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableApache
cpe:2.3:a:apache:camel:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableApache
cpe:2.3:a:apache:camel:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableApache
cpe:2.3:a:apache:camel:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableApache
cpe:2.3:a:apache:camel:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableApache
cpe:2.3:a:apache:camel:2.7.4:*:*:*:*:*:*:*2.7.4VulnerableApache
cpe:2.3:a:apache:camel:2.7.5:*:*:*:*:*:*:*2.7.5VulnerableApache
cpe:2.3:a:apache:camel:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableApache
cpe:2.3:a:apache:camel:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableApache
cpe:2.3:a:apache:camel:2.8.2:*:*:*:*:*:*:*2.8.2VulnerableApache
  • cpe:2.3:a:apache:camel:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·Apache
Show 48 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:2.8.3:*:*:*:*:*:*:*2.8.3VulnerableApache
cpe:2.3:a:apache:camel:2.8.4:*:*:*:*:*:*:*2.8.4VulnerableApache
cpe:2.3:a:apache:camel:2.8.5:*:*:*:*:*:*:*2.8.5VulnerableApache
cpe:2.3:a:apache:camel:2.8.6:*:*:*:*:*:*:*2.8.6VulnerableApache
cpe:2.3:a:apache:camel:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableApache
cpe:2.3:a:apache:camel:2.9.1:*:*:*:*:*:*:*2.9.1VulnerableApache
cpe:2.3:a:apache:camel:2.9.2:*:*:*:*:*:*:*2.9.2VulnerableApache
cpe:2.3:a:apache:camel:2.9.3:*:*:*:*:*:*:*2.9.3VulnerableApache
cpe:2.3:a:apache:camel:2.9.4:*:*:*:*:*:*:*2.9.4VulnerableApache
cpe:2.3:a:apache:camel:2.9.5:*:*:*:*:*:*:*2.9.5VulnerableApache
cpe:2.3:a:apache:camel:2.9.6:*:*:*:*:*:*:*2.9.6VulnerableApache
cpe:2.3:a:apache:camel:2.9.7:*:*:*:*:*:*:*2.9.7VulnerableApache
cpe:2.3:a:apache:camel:2.9.8:*:*:*:*:*:*:*2.9.8VulnerableApache
cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableApache
cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableApache
cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*2.10.2VulnerableApache
cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*2.10.3VulnerableApache
cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*2.10.4VulnerableApache
cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*2.10.5VulnerableApache
cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*2.10.6VulnerableApache
cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*2.10.7VulnerableApache
cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableApache
cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*2.11.1VulnerableApache
cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*2.11.2VulnerableApache
cpe:2.3:a:apache:camel:2.11.3:*:*:*:*:*:*:*2.11.3VulnerableApache
cpe:2.3:a:apache:camel:2.11.4:*:*:*:*:*:*:*2.11.4VulnerableApache
cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableApache
cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*2.12.1VulnerableApache
cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*2.12.2VulnerableApache
cpe:2.3:a:apache:camel:2.12.3:*:*:*:*:*:*:*2.12.3VulnerableApache
cpe:2.3:a:apache:camel:2.12.4:*:*:*:*:*:*:*2.12.4VulnerableApache
cpe:2.3:a:apache:camel:2.12.5:*:*:*:*:*:*:*2.12.5VulnerableApache
cpe:2.3:a:apache:camel:2.13.0:*:*:*:*:*:*:*2.13.0VulnerableApache
cpe:2.3:a:apache:camel:2.13.1:*:*:*:*:*:*:*2.13.1VulnerableApache
cpe:2.3:a:apache:camel:2.13.2:*:*:*:*:*:*:*2.13.2VulnerableApache
cpe:2.3:a:apache:camel:2.13.3:*:*:*:*:*:*:*2.13.3VulnerableApache
cpe:2.3:a:apache:camel:2.13.4:*:*:*:*:*:*:*2.13.4VulnerableApache
cpe:2.3:a:apache:camel:2.14.0:*:*:*:*:*:*:*2.14.0VulnerableApache
cpe:2.3:a:apache:camel:2.14.1:*:*:*:*:*:*:*2.14.1VulnerableApache
cpe:2.3:a:apache:camel:2.14.2:*:*:*:*:*:*:*2.14.2VulnerableApache
cpe:2.3:a:apache:camel:2.14.3:*:*:*:*:*:*:*2.14.3VulnerableApache
cpe:2.3:a:apache:camel:2.14.4:*:*:*:*:*:*:*2.14.4VulnerableApache
cpe:2.3:a:apache:camel:2.15.0:*:*:*:*:*:*:*2.15.0VulnerableApache
cpe:2.3:a:apache:camel:2.15.1:*:*:*:*:*:*:*2.15.1VulnerableApache
cpe:2.3:a:apache:camel:2.15.2:*:*:*:*:*:*:*2.15.2VulnerableApache
cpe:2.3:a:apache:camel:2.15.3:*:*:*:*:*:*:*2.15.3VulnerableApache
cpe:2.3:a:apache:camel:2.15.4:*:*:*:*:*:*:*2.15.4VulnerableApache
cpe:2.3:a:apache:camel:2.16.0:*:*:*:*:*:*:*2.16.0VulnerableApache
  • cpe:2.3:a:apache:camel:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.5:*:*:*:*:*:*:* Versions 2.8.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.6:*:*:*:*:*:*:* Versions 2.8.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.1:*:*:*:*:*:*:* Versions 2.9.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.2:*:*:*:*:*:*:* Versions 2.9.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.3:*:*:*:*:*:*:* Versions 2.9.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.4:*:*:*:*:*:*:* Versions 2.9.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.5:*:*:*:*:*:*:* Versions 2.9.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.6:*:*:*:*:*:*:* Versions 2.9.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.7:*:*:*:*:*:*:* Versions 2.9.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.8:*:*:*:*:*:*:* Versions 2.9.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:* Versions 2.10.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:* Versions 2.10.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:* Versions 2.10.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:* Versions 2.10.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:* Versions 2.10.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:* Versions 2.10.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:* Versions 2.11.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:* Versions 2.11.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.3:*:*:*:*:*:*:* Versions 2.11.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.4:*:*:*:*:*:*:* Versions 2.11.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:* Versions 2.12.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:* Versions 2.12.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.3:*:*:*:*:*:*:* Versions 2.12.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.4:*:*:*:*:*:*:* Versions 2.12.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.5:*:*:*:*:*:*:* Versions 2.12.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.13.0:*:*:*:*:*:*:* Versions 2.13.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.13.1:*:*:*:*:*:*:* Versions 2.13.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.13.2:*:*:*:*:*:*:* Versions 2.13.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.13.3:*:*:*:*:*:*:* Versions 2.13.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.13.4:*:*:*:*:*:*:* Versions 2.13.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.14.0:*:*:*:*:*:*:* Versions 2.14.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.14.1:*:*:*:*:*:*:* Versions 2.14.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.14.2:*:*:*:*:*:*:* Versions 2.14.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.14.3:*:*:*:*:*:*:* Versions 2.14.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.14.4:*:*:*:*:*:*:* Versions 2.14.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.15.0:*:*:*:*:*:*:* Versions 2.15.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.15.1:*:*:*:*:*:*:* Versions 2.15.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.15.2:*:*:*:*:*:*:* Versions 2.15.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.15.3:*:*:*:*:*:*:* Versions 2.15.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.15.4:*:*:*:*:*:*:* Versions 2.15.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.16.0:*:*:*:*:*:*:* Versions 2.16.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-jetty (Maven) Fixed in 2.15.5 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-jetty (Maven) Fixed in 2.16.1 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-servlet (Maven) Fixed in 2.15.5 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-servlet (Maven) Fixed in 2.16.1 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-http (Maven) Fixed in 2.15.5 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-http (Maven) Fixed in 2.16.1 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-http-common (Maven) Fixed in 2.15.5 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-http-common (Maven) Fixed in 2.16.1 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-http4 (Maven) Fixed in 2.15.5 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-http4 (Maven) Fixed in 2.16.1 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-ahc (Maven) Fixed in 2.15.5 Advisory →
  • Fix · GHSA-26v6-w6fw-rh94 org.apache.camel:camel-ahc (Maven) Fixed in 2.16.1 Advisory →

Red Hat 1 advisory

  • RHSA-2016:2035 Released 2016-10-06 · Red Hat rating Important
    Red Hat JBoss Fuse 6.3 security update
    • Red Hat JBoss Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix yet
Red Hat JBoss Fuse Service Works 6AffectedNo fix yet
Red Hat OpenShift Enterprise 2AffectedNo fix yet
Red Hat JBoss Fuse 6.3Fixed RHSA-2016:2035
Not affected: 2 products
  • Red Hat BPM Suite 6
  • Red Hat JBoss BRMS 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-5348
  2. 2026-10-03 Alias added: GHSA-26v6-w6fw-rh94

References

Advisory 5

Other 27

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences