CVE-2026-85248: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization in Apache Software Foundation Apache Camel

The vulnerability arises because Apache Camel's PQC component holds a single java.security.Signature instance shared among all exchanges without synchronizing access. Since Signature is stateful and not thread-safe, concurrent usage causes interleaving of update() and verify() calls from different messages. This leads to non-deterministic verification results, including false positives where a message's signature is reported as valid without actual verification. The flaw affects Apache Camel versions >=4.12.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is fixed in Apache Camel 4.18.5, 4.22.1, and 4.23.0 by no longer sharing the Signature instance across concurrent exchanges. Temporary mitigation involves limiting concurrency to a single consumer on the affected route.

The vulnerability can cause signature verification to incorrectly succeed for messages whose signatures were never properly checked, defeating the integrity guarantees provided by the PQC component. This undermines trust in message authenticity and could allow malicious or corrupted messages to be accepted as valid. Exploitation requires concurrent traffic through the same endpoint, which is common under load. There is no indication of known exploits in the wild.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, to 4.22.1 if using the 4.22.x LTS stream, or to 4.23.0 or later where the issue is fully resolved. For deployments unable to upgrade immediately, restrict the affected route to a single concurrent consumer to prevent concurrent use of the shared Signature instance.