Read the docs
TI-2017-09358 Aliases CVE-2017-12633GHSA-5whj-523x-6j68

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 52CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

Why it matters now

EPSS 0.07194 94th percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-hessian (Maven): 2.19.4, 2.20.1Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel2.19.0 to 2.19.3; 2.20.0; The unsupported Camel 2.x (2.18 and earlier) versions may be also affected.—No fix listedCNA
—org.apache.camel:camel-hessian (Maven)2.0 to before 2.19.42.19.4Patch availableGHSA-5whj-523x-6j68
—org.apache.camel:camel-hessian (Maven)2.20.0 to before 2.20.12.20.1Patch availableGHSA-5whj-523x-6j68
  • Apache Camel VendorApache Affected 2.19.0 to 2.19.3; 2.20.0; The unsupported Camel 2.x (2.18 and earlier) versions may be also affected. Fixed in — No fix listed CNA
  • org.apache.camel:camel-hessian (Maven) Vendor— Affected 2.0 to before 2.19.4 Fixed in 2.19.4 Patch available GHSA-5whj-523x-6j68
  • org.apache.camel:camel-hessian (Maven) Vendor— Affected 2.20.0 to before 2.20.1 Fixed in 2.20.1 Patch available GHSA-5whj-523x-6j68

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*2.0.0 to before 2.19.4; 2.20.0 to before 2.20.1VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.19.4; 2.20.0 to before 2.20.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-5whj-523x-6j68 org.apache.camel:camel-hessian (Maven) Fixed in 2.19.4 Advisory →
  • Fix · GHSA-5whj-523x-6j68 org.apache.camel:camel-hessian (Maven) Fixed in 2.20.1 Advisory →

Red Hat 1 advisory

  • RHSA-2018:0319 Released 2018-02-14 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6.3Fixed RHSA-2018:0319
Red Hat JBoss Fuse 6.3Fixed RHSA-2018:0319

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12633
  2. 2026-10-03 Alias added: GHSA-5whj-523x-6j68

References

Advisory 4

Other 4

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences