Deserialization of untrusted data in Apache Camel
Priority MEDIUM 51CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
Why it matters now
EPSS 0.06286 93rd percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-snakeyaml (Maven): 2.17.5, 2.18.2Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 2.17.0 to 2.17.4; 2.18.0 to 2.18.1; The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. | — | No fix listed | CNA |
| — | org.apache.camel:camel-snakeyaml (Maven) | before 2.17.5 | 2.17.5 | Patch available | GHSA-hvpr-9cr6-q5v7 |
| — | org.apache.camel:camel-snakeyaml (Maven) | 2.18.0 to before 2.18.2 | 2.18.2 | Patch available | GHSA-hvpr-9cr6-q5v7 |
- Apache Camel VendorApache Affected 2.17.0 to 2.17.4; 2.18.0 to 2.18.1; The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. Fixed in — No fix listed CNA
- org.apache.camel:camel-snakeyaml (Maven) Vendor— Affected before 2.17.5 Fixed in 2.17.5 Patch available GHSA-hvpr-9cr6-q5v7
- org.apache.camel:camel-snakeyaml (Maven) Vendor— Affected 2.18.0 to before 2.18.2 Fixed in 2.18.2 Patch available GHSA-hvpr-9cr6-q5v7
Remediation
- Fix · GHSA-hvpr-9cr6-q5v7 org.apache.camel:camel-snakeyaml (Maven) Fixed in 2.17.5 Advisory →
- Fix · GHSA-hvpr-9cr6-q5v7 org.apache.camel:camel-snakeyaml (Maven) Fixed in 2.18.2 Advisory →
Red Hat 1 advisory
- RHSA-2017:0868 Released 2017-04-03 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:0868 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:0868 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3159
- 2026-10-03 Alias added: GHSA-hvpr-9cr6-q5v7
References
Advisory 6
- RHSA-2017:0868
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
- [oss-security] 20170522 Code Execution through a variety Java (Un-)Marshallers
- http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2
- https://nvd.nist.gov/vuln/detail/CVE-2017-3159
- https://github.com/advisories/GHSA-hvpr-9cr6-q5v7
Other 13
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/commit/20e26226107f3133c87d0f5c845e02f824823f69
- https://github.com/apache/camel/commit/21c04b635cacd57bf4d438fc2308533ca1babde9
- https://github.com/apache/camel/commit/2f19ce59cc4d89f21455f47604915fab6a22233b
- https://github.com/apache/camel/commit/6b979d07fd4be6ac913368f2abeae690d3325d37
- https://github.com/apache/camel/commit/bea972e99b5c75dc0edeb93ecbba9ff70c36bb43
- https://github.com/apache/camel/commit/c98e48a7421b813bd47d5ae2717aea35a98d187
- https://github.com/apache/camel/commit/dcb5a74a3987d2264ad195c7844bbb6c8121661
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-10575
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-3159 · CVE Program
- CVE-2017-3159 · NVD
- FIRST EPSS
- GHSA-hvpr-9cr6-q5v7 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-3159 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences