CVE-2026-88900: CWE-502 Deserialization of Untrusted Data in Apache Software Foundation Apache Camel

The vulnerability in Apache Camel's Camel-Jgroups component involves unsafe Java deserialization of messages received via JGroups. The method JGroupsEndpoint.createExchange calls getObject() on org.jgroups.Message, which deserializes the payload without any java.io.ObjectInputFilter, unless a JVM-wide filter is set externally. The default JGroups protocol stack uses UDP multicast without authentication or encryption, allowing any host with network access to join the cluster and send malicious serialized objects. These objects can trigger remote code execution during deserialization if exploitable gadget chains exist on the classpath. The vulnerability affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in versions 4.18.5, 4.22.1, and 4.23.0. Older release lines are end-of-life and will not receive fixes.

An attacker with network access to the cluster's multicast group or bind port can send crafted serialized objects to the vulnerable Apache Camel consumer. This can lead to remote code execution within the Camel process if a suitable deserialization gadget chain is present on the classpath. The vulnerability allows full confidentiality, integrity, and availability compromise of the affected system. The severity is rated high (CVSS 8.8) due to the requirement for network adjacency and the presence of gadget chains.

Users should upgrade Apache Camel to version 4.23.0 or later. If on the 4.22.x release stream, upgrade to 4.22.1. If on the 4.18.x release stream, upgrade to 4.18.5. Versions 4.14.x and earlier, and 4.15.x to 4.17.x and 4.19.x to 4.21.x are end-of-life and will not receive fixes; users must migrate to supported versions. No alternative mitigations are described in the vendor advisory. Applying JVM-wide serialization filters may help but is not a substitute for upgrading.