Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
Priority MEDIUM 55CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
Why it matters now
EPSS 0.10604 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.camel:camel-jackson (Maven): 2.16.5, 2.17.5, 2.18.2Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 2.16.0 to 2.16.4; 2.17.0 to 2.17.4; 2.18.0 to 2.18.1; The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. | — | No fix listed | CNA |
| — | org.apache.camel:camel-jackson (Maven) | before 2.16.5 | 2.16.5 | Patch available | GHSA-vvjc-q5vr-52q6 |
| — | org.apache.camel:camel-jackson (Maven) | 2.17.0 to before 2.17.5 | 2.17.5 | Patch available | GHSA-vvjc-q5vr-52q6 |
| — | org.apache.camel:camel-jackson (Maven) | 2.18.0 to before 2.18.2 | 2.18.2 | Patch available | GHSA-vvjc-q5vr-52q6 |
- Apache Camel VendorApache Affected 2.16.0 to 2.16.4; 2.17.0 to 2.17.4; 2.18.0 to 2.18.1; The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. Fixed in — No fix listed CNA
- org.apache.camel:camel-jackson (Maven) Vendor— Affected before 2.16.5 Fixed in 2.16.5 Patch available GHSA-vvjc-q5vr-52q6
- org.apache.camel:camel-jackson (Maven) Vendor— Affected 2.17.0 to before 2.17.5 Fixed in 2.17.5 Patch available GHSA-vvjc-q5vr-52q6
- org.apache.camel:camel-jackson (Maven) Vendor— Affected 2.18.0 to before 2.18.2 Fixed in 2.18.2 Patch available GHSA-vvjc-q5vr-52q6
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:2.16.0:*:*:*:*:*:*:* | 2.16.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.16.1:*:*:*:*:*:*:* | 2.16.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.16.2:*:*:*:*:*:*:* | 2.16.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.16.3:*:*:*:*:*:*:* | 2.16.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.16.4:*:*:*:*:*:*:* | 2.16.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.0:*:*:*:*:*:*:* | 2.17.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.1:*:*:*:*:*:*:* | 2.17.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.2:*:*:*:*:*:*:* | 2.17.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.3:*:*:*:*:*:*:* | 2.17.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:camel:2.17.4:*:*:*:*:*:*:* | 2.17.4 | Vulnerable | Apache |
- cpe:2.3:a:apache:camel:2.16.0:*:*:*:*:*:*:* Versions 2.16.0 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.16.1:*:*:*:*:*:*:* Versions 2.16.1 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.16.2:*:*:*:*:*:*:* Versions 2.16.2 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.16.3:*:*:*:*:*:*:* Versions 2.16.3 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.16.4:*:*:*:*:*:*:* Versions 2.16.4 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.0:*:*:*:*:*:*:* Versions 2.17.0 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.1:*:*:*:*:*:*:* Versions 2.17.1 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.2:*:*:*:*:*:*:* Versions 2.17.2 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.3:*:*:*:*:*:*:* Versions 2.17.3 Vulnerable ·Apache
- cpe:2.3:a:apache:camel:2.17.4:*:*:*:*:*:*:* Versions 2.17.4 Vulnerable ·Apache
Remediation
- Fix · GHSA-vvjc-q5vr-52q6 org.apache.camel:camel-jackson (Maven) Fixed in 2.16.5 Advisory →
- Fix · GHSA-vvjc-q5vr-52q6 org.apache.camel:camel-jackson (Maven) Fixed in 2.17.5 Advisory →
- Fix · GHSA-vvjc-q5vr-52q6 org.apache.camel:camel-jackson (Maven) Fixed in 2.18.2 Advisory →
Red Hat 1 advisory
- RHSA-2017:1832 Released 2017-08-10 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | — |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:1832 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:1832 |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8749
- 2026-10-03 Alias added: GHSA-vvjc-q5vr-52q6
References
Advisory 5
- RHSA-2017:1832
- http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2
- [oss-security] 20170522 Code Execution through a variety Java (Un-)Marshallers
- https://nvd.nist.gov/vuln/detail/CVE-2016-8749
- https://github.com/advisories/GHSA-vvjc-q5vr-52q6
Other 19
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/commit/10f552643d7e4565104d142bbc160db5a30f9f7e
- https://github.com/apache/camel/commit/235036d2396ae45b6809b72a1983dee33b5ba326
- https://github.com/apache/camel/commit/2b0e96117d6f01eba0c18e2ff8df6a438e819721
- https://github.com/apache/camel/commit/57d01e2fc8923263df896e9810329ee5b7f9b69e
- https://github.com/apache/camel/commit/5ae9c0dcc4843347cd01ffb58ce5dd0687755a14
- https://github.com/apache/camel/commit/7567488f844f01d72840f7ab6ca18114a11f20d8
- https://github.com/apache/camel/commit/83fef7108456eeac1506853d194cd1360851c4fe
- https://github.com/apache/camel/commit/881e5099f94316d4a66ffbff0a3e6915829d49d7
- https://github.com/apache/camel/commit/8c862aa11e31d0f804c4a4516a0715e05e3eebcf
- https://github.com/apache/camel/commit/abb45b2c2ada2bbb34138230540b37d259c1e98d
- https://github.com/apache/camel/commit/ccf149c76bf37adc5977dc626e141a14e60b5aee
- https://github.com/apache/camel/commit/d4102512147eca2af21c3b6ed63a67d852f4e66a
- https://issues.apache.org/jira/browse/CAMEL-10604
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
- https://issues.apache.org/jira/browse/CAMEL-10567
- https://github.com/apache/camel
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2016-8749 · CVE Program
- CVE-2016-8749 · NVD
- FIRST EPSS
- GHSA-vvjc-q5vr-52q6 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-8749 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences