CVE-2026-88900
Received Received - Intake

Deserialization of Untrusted Data in Apache Camel

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-88900
EUVD
EUVD-2026-104244

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88900 is a deserialization of untrusted data vulnerability in Apache Camel's camel-jgroups component. It allows remote code execution when an attacker sends a crafted serialized object to the JGroups consumer. The issue occurs because the consumer deserializes payloads without applying Java deserialization filters, enabling instantiation of arbitrary serializable classes if a gadget chain exists on the classpath. Exploitation requires network access to the cluster's multicast group or bind port.

Detection Guidance

Check Apache Camel version with `camel --version` or inspect Maven/Gradle dependencies for camel-jgroups. Look for JGroups consumer endpoints using `from("jgroups:...")` without AUTH/encryption. Monitor logs for failed consumer startup in version 4.23.0+ due to missing deserialization controls.

Impact Analysis

This vulnerability can lead to remote code execution in the Camel process if an attacker exploits it. It may allow unauthorized access to sensitive data, disruption of services, or further network compromise. The impact depends on the privileges of the Camel application and the presence of exploitable gadget chains on the classpath.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling remote code execution through unsafe Java deserialization. If exploited, it may lead to unauthorized data access, modification, or exfiltration, violating confidentiality and integrity requirements under these regulations. The lack of pre-read deserialization controls and default unauthenticated JGroups channels exacerbates this risk.

Mitigation Strategies

Upgrade to fixed versions: 4.18.5, 4.22.1, or 4.23.0. For 4.23.0, configure JVM serialization filter `-Djdk.serialFilter` or secure JGroups channel with AUTH+SYM_ENCRYPT/ASYM_ENCRYPT. Set `acceptAllObjects=true` only if absolutely necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88900. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart