Read the docs
TI-2017-09359 Aliases CVE-2017-12634GHSA-vf4q-8mr7-5c5c

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 52CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

Why it matters now

EPSS 0.07194 94th percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-castor (Maven): 2.19.4, 2.20.1Red Hat: 1 advisoryRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel2.19.0 to 2.19.3; 2.20.0; The unsupported Camel 2.x (2.18 and earlier) versions may be also affected.—No fix listedCNA
—org.apache.camel:camel-castor (Maven)2.0.0 to before 2.19.42.19.4Patch availableGHSA-vf4q-8mr7-5c5c
—org.apache.camel:camel-castor (Maven)2.20.0 to before 2.20.12.20.1Patch availableGHSA-vf4q-8mr7-5c5c
  • Apache Camel VendorApache Affected 2.19.0 to 2.19.3; 2.20.0; The unsupported Camel 2.x (2.18 and earlier) versions may be also affected. Fixed in — No fix listed CNA
  • org.apache.camel:camel-castor (Maven) Vendor— Affected 2.0.0 to before 2.19.4 Fixed in 2.19.4 Patch available GHSA-vf4q-8mr7-5c5c
  • org.apache.camel:camel-castor (Maven) Vendor— Affected 2.20.0 to before 2.20.1 Fixed in 2.20.1 Patch available GHSA-vf4q-8mr7-5c5c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*2.0.0 to before 2.19.4VulnerableApache
cpe:2.3:a:apache:camel:2.20.0:*:*:*:*:*:*:*2.20.0VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.19.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.20.0:*:*:*:*:*:*:* Versions 2.20.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-vf4q-8mr7-5c5c org.apache.camel:camel-castor (Maven) Fixed in 2.19.4 Advisory →
  • Fix · GHSA-vf4q-8mr7-5c5c org.apache.camel:camel-castor (Maven) Fixed in 2.20.1 Advisory →

Red Hat 1 advisory

  • RHSA-2018:0319 Released 2018-02-14 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6.3Fixed RHSA-2018:0319
Red Hat JBoss Fuse 6.3Fixed RHSA-2018:0319

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12634
  2. 2026-10-03 Alias added: GHSA-vf4q-8mr7-5c5c

References

Advisory 5

Other 11

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences