CVE-2026-85248
Received Received - Intake

Race Condition in Apache Camel PQC Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85248
EUVD
EUVD-2026-104189

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.12.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in Apache Camel's PQC component. It occurs because a single java.security.Signature instance is shared across multiple concurrent exchanges without proper synchronization. The Signature class is stateful and not thread-safe, so concurrent updates and verifications can interleave, causing verifications to complete against incorrect or partial data. This can lead to successful verifications for messages that were never actually signed.

Detection Guidance

This vulnerability is specific to Apache Camel's PQC component and requires detecting concurrent access to a shared Signature instance. Check logs for verification failures or non-deterministic signature checks in Camel routes using the PQC component. Monitor for inconsistent security outcomes under load.

Impact Analysis

The impact includes potential security breaches where invalid or tampered messages are incorrectly verified as authentic. This defeats the purpose of the component, which is to ensure message integrity. Attackers could exploit this to bypass security checks, leading to unauthorized access or data manipulation in systems relying on this component.

Compliance Impact

This vulnerability could lead to non-compliance with data integrity and security requirements in GDPR and HIPAA. GDPR requires ensuring data integrity and security, while HIPAA mandates protection against unauthorized access. Exploiting this flaw could result in unauthorized data access or tampering, violating these regulations and potentially leading to legal penalties.

Mitigation Strategies
  • Upgrade Apache Camel to version 4.23.0 or apply the latest patches for your LTS stream (4.18.5 for 4.18.x, 4.22.1 for 4.22.x).
  • If immediate upgrade is not possible, restrict the affected route to a single concurrent consumer to prevent shared Signature instance access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart