Deserialization Vulnerability in Apache Camel's Spring Redis Component
CVE-2026-78165

8.8HIGH

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78165?

A deserialization of untrusted data vulnerability exists in the Spring Redis component of Apache Camel, affecting versions prior to 4.23.0. This flaw occurs due to the use of a default serializer that lacks adequate filtering, enabling potential attackers to exploit untrusted data for arbitrary code execution. The vulnerability arises when the Redis consumer processes messages without appropriate validation, posing significant risks, especially if configured to accept input from untrusted sources. Users are strongly advised to upgrade to the latest versions to mitigate risks and to implement additional security measures, such as customizing serialization settings and enhancing network access controls.

Affected Version(s)

Apache Camel 2.11.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78165
Created by oscerd