A deserialization of untrusted data vulnerability exists in Apache Camel's camel-hazelcast component in versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Certain configuration paths fail to apply Java deserialization filters, allowing an attacker able to publish data into the connected Hazelcast cluster to cause arbitrary Java object deserialization, potentially leading to remote code execution. Hazelcast clusters lack authentication and TLS by default, increasing exposure. Upgrades to Apache Camel 4.23.0, 4.22.1, or 4.18.5 fix this issue. Workarounds include supplying explicit Hazelcast configurations with deserialization filters, injecting pre-built Hazelcast instances, setting JVM-wide serialization filters, and enabling Hazelcast cluster authentication and TLS.