Read the docs
TI-2026-20815 Aliases CVE-2026-25747GHSA-429q-mrc4-38fr

Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB

Priority MEDIUM 49CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01257 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial Apache Camel LevelDB (Apache Software Foundation): 4.10.9, 4.14.5, 4.18.0org.apache.camel:camel-leveldb (Maven): 4.10.9, 4.14.5, 4.18.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel LevelDB3.0.0 to before 4.10.9; 4.14.0 to before 4.14.5; 4.15.0 to before 4.18.04.10.9, 4.14.5, 4.18.0Patch availableCNA
—org.apache.camel:camel-leveldb (Maven)3.0.0 to before 4.10.94.10.9Patch availableGHSA-429q-mrc4-38fr
—org.apache.camel:camel-leveldb (Maven)4.11.0 to before 4.14.54.14.5Patch availableGHSA-429q-mrc4-38fr
—org.apache.camel:camel-leveldb (Maven)4.15.0 to before 4.18.04.18.0Patch availableGHSA-429q-mrc4-38fr
  • Apache Camel LevelDB VendorApache Affected 3.0.0 to before 4.10.9; 4.14.0 to before 4.14.5; 4.15.0 to before 4.18.0 Fixed in 4.10.9, 4.14.5, 4.18.0 Patch available CNA
  • org.apache.camel:camel-leveldb (Maven) Vendor— Affected 3.0.0 to before 4.10.9 Fixed in 4.10.9 Patch available GHSA-429q-mrc4-38fr
  • org.apache.camel:camel-leveldb (Maven) Vendor— Affected 4.11.0 to before 4.14.5 Fixed in 4.14.5 Patch available GHSA-429q-mrc4-38fr
  • org.apache.camel:camel-leveldb (Maven) Vendor— Affected 4.15.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-429q-mrc4-38fr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*3.0.0 to before 4.10.9; 4.11.0 to before 4.14.5; 4.15.0 to before 4.18.0VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.10.9; 4.11.0 to before 4.14.5; 4.15.0 to before 4.18.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Camel LevelDB (Apache Software Foundation) Fixed in 4.10.9, 4.14.5, 4.18.0
  • Fix · GHSA-429q-mrc4-38fr org.apache.camel:camel-leveldb (Maven) Fixed in 4.10.9 Advisory →
  • Fix · GHSA-429q-mrc4-38fr org.apache.camel:camel-leveldb (Maven) Fixed in 4.14.5 Advisory →
  • Fix · GHSA-429q-mrc4-38fr org.apache.camel:camel-leveldb (Maven) Fixed in 4.18.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix planned: Will not fix
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25747
  2. 2026-10-03 Alias added: GHSA-429q-mrc4-38fr

References

Exploit 1

Advisory 3

Other 5

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences