The Apache Camel LevelDB component contains a deserialization vulnerability (CWE-502) due to the DefaultLevelDBSerializer class using java.io.ObjectInputStream without applying ObjectInputFilter or class-loading restrictions when deserializing data from LevelDB aggregation repository files. This allows an attacker with write access to the LevelDB database files to inject malicious serialized Java objects. When deserialized during normal operations, these objects can trigger arbitrary code execution within the application's context. The vulnerability affects Apache Camel versions 4.10.0 up to but not including 4.10.8, 4.14.0 up to but not including 4.14.5, and 4.15.0 up to but not including 4.18.0. Fixed versions are 4.10.9, 4.14.5, and 4.18.0. Red Hat's advisory rates this as an important vulnerability with no suitable mitigations other than upgrading to fixed versions.

Successful exploitation allows arbitrary code execution within the context of the Apache Camel application. This can lead to full system compromise depending on the application's privileges. The vulnerability requires an attacker to have write access to the LevelDB database files used by the application. The CVSS 3.1 base score is 8.8 (High), reflecting network attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

The primary mitigation is to upgrade affected Apache Camel LevelDB component versions to 4.10.9, 4.14.5, or 4.18.0 as appropriate. Red Hat's advisory states that no other mitigations currently meet their criteria for ease of use, applicability, or stability. Users should ensure that only trusted entities have write access to LevelDB database files as a general security measure. Patch status is confirmed: fixed versions are available.